# Builds the example app with the SDK from this checkout. Build context is the
# repository root (see docker-compose.yml).
#
# Two stages on Wolfi-based Python images: the `-dev` image has pip and a
# shell for the install; the runtime image has neither, runs as `nonroot`
# (uid 65532) and carries no OS-level CVEs, which is what image scanners
# expect from a service image. glibc, so every manylinux wheel
# (confluent-kafka, pyroscope-io, grpcio) installs as is. The `latest` tags
# are the free ones and track the newest CPython; pin versioned tags if your
# registry account has them.
FROM cgr.dev/chainguard/python:latest-dev AS build

USER root
WORKDIR /app
COPY pyproject.toml README.md LICENSE ./
COPY autonomize_observer ./autonomize_observer
RUN python -m venv /app/venv \
    && /app/venv/bin/pip install --no-cache-dir --upgrade pip \
    && /app/venv/bin/pip install --no-cache-dir ".[service]" \
        "uvicorn>=0.30" "httpx>=0.27" "aiosqlite>=0.20" "sqlalchemy[asyncio]>=2.0,<2.1" \
        "urllib3>=2.8.0" \
    && /app/venv/bin/pip uninstall -y pip

FROM cgr.dev/chainguard/python:latest

WORKDIR /app
COPY --from=build --chown=nonroot:nonroot /app/venv /app/venv
COPY --chown=nonroot:nonroot examples/service-telemetry/app.py ./app.py
# The base image already runs as nonroot (uid 65532); stated so scanners see it.
USER nonroot
ENV PATH=/app/venv/bin:$PATH
EXPOSE 8000
ENTRYPOINT ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "8000"]
