# Dockerfile — single image for the web process and every worker.
# Same code, same deps; the command differs per container (see compose).
FROM python:3.12-slim

# No .pyc, unbuffered logs (so container logs stream in real time).
ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

WORKDIR /app

# Deps first for layer caching.
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# App code. config/ ships with recommended YAML values (non-secret). Secrets
# arrive at runtime via Docker Secrets / env — never baked into the image.
COPY . .

# The SQLite file lives on a MOUNTED LOCAL VOLUME, not in the image. Contract
# (foundation §workers): local volume, same machine, never over a network FS.
# DB_PATH points into that mount (see compose).
VOLUME ["/data"]

# Non-root runtime.
RUN useradd --create-home --uid 10001 fabbro && chown -R fabbro /app
USER fabbro

EXPOSE 8000

# Default command is the web server. Workers override `command` in compose.
CMD ["gunicorn", "--workers", "3", "--bind", "0.0.0.0:8000", "--preload", \
     "--access-logfile", "-", "--error-logfile", "-", "app:app"]