ARG PYTHON_IMAGE=python:3.12-slim@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de
FROM ${PYTHON_IMAGE} AS builder

WORKDIR /src
COPY pyproject.toml README.md ./
COPY prometa ./prometa
RUN python -m pip wheel --no-cache-dir --wheel-dir /wheels ".[runtime-host,runtime-mcp]"

FROM ${PYTHON_IMAGE}

ARG VCS_REF=unknown
ARG IMAGE_VERSION=0.18.2

LABEL org.opencontainers.image.title="Prometa reference tenant runtime" \
      org.opencontainers.image.description="Tenant-deployed host for signed Orchestra runtime releases" \
      org.opencontainers.image.source="https://github.com/prometa-ai/orchestra-python-sdk" \
      org.opencontainers.image.revision="${VCS_REF}" \
      org.opencontainers.image.version="${IMAGE_VERSION}" \
      io.prometa.image.variant="debian"

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PORT=8080 \
    PROMETA_RUNTIME_CONFIG=/etc/prometa-runtime/config.json

RUN groupadd --gid 10001 runtime \
    && useradd --uid 10001 --gid runtime --create-home --shell /usr/sbin/nologin runtime
COPY --from=builder /wheels /wheels
RUN python -m pip install --no-cache-dir --no-index --find-links=/wheels \
      "prometa-sdk[runtime-host,runtime-mcp]==0.18.2" \
    && rm -rf /wheels

USER 10001:10001
EXPOSE 8080

HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=3 \
  CMD ["python", "-c", "import os,urllib.request; urllib.request.urlopen('http://127.0.0.1:%s/healthz' % os.environ.get('PORT','8080'), timeout=2).read()"]

ENTRYPOINT ["prometa-runtime-host"]
