# Multi-stage build, non-root runtime user, healthcheck — same pattern as
# deploy/docker/Dockerfile (the existing Private Deployment image), kept
# consistent rather than inventing a second convention for the same repo.

# ---- Builder ------------------------------------------------------------------
FROM python:3.12-slim AS builder

WORKDIR /build
RUN apt-get update && apt-get install -y --no-install-recommends \
        build-essential \
    && rm -rf /var/lib/apt/lists/*

COPY pyproject.toml ../README.md ./
COPY app/ ./app/
COPY main.py ./
RUN pip install --no-cache-dir --target=/build/deps .

# ---- Runtime --------------------------------------------------------------------
FROM python:3.12-slim AS runtime

RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
    && rm -rf /var/lib/apt/lists/*

RUN useradd --create-home --uid 1000 meridian

WORKDIR /app
COPY --from=builder /build/deps /usr/local/lib/python3.12/site-packages
COPY app/ ./app/
COPY main.py ./

ENV PYTHONPATH=/app
ENV PYTHONUNBUFFERED=1

USER meridian
EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD python -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8080/health', timeout=3).status == 200 else 1)" || exit 1

CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8080"]
