# MicroVM image for the Pulse report sandbox (AWS Lambda MicroVMs; DD-054).
#
# Build via `scripts/build_microvm_image.py` (zips this Dockerfile + server.py to
# S3 → create-microvm-image). The Lambda **managed base image** (the microVM OS +
# service components) is supplied separately with --base-image-arn, NOT here; this
# FROM is only the application layer stacked on top of it.
#
# This is the shared "fat" image: it bakes the toolchains our skills invoke so a
# NEW SKILL never needs an image rebuild — only a genuinely new binary/package
# does (skill content itself is synced from DB/S3 at run time). Keep the toolchain
# list tight; each addition grows the snapshot.
#
# NOTE: the agent server serves plain HTTP on :8080 (Lambda's ingress terminates
# TLS), so nothing does OpenSSL crypto at snapshot time — safe on python:3.12-slim.
# If you ever add in-process TLS, switch to the Lambda base container image
# (snapshot-compatible OpenSSL) so microVMs don't share seeded RNG state.
FROM python:3.12-slim

WORKDIR /app

# Skill toolchains (system binaries the skills' scripts shell out to):
#   libreoffice  → docx/xlsx/pptx rendering & conversion
#   pandoc       → document format conversion
#   chromium     → headless HTML → PDF
#   fonts        → consistent rendering in the above
RUN apt-get update && apt-get install -y --no-install-recommends \
        libreoffice \
        pandoc \
        chromium \
        fonts-dejavu \
        fonts-liberation \
    && rm -rf /var/lib/apt/lists/*

# Python deps: the agent server + common report-authoring libraries so skill
# scripts import them without a per-run `pip install`.
RUN pip install --no-cache-dir \
        "fastapi>=0.115,<1" \
        "uvicorn[standard]>=0.34,<1" \
        "weasyprint>=63,<64" \
        "python-docx>=1.1,<2" \
        "openpyxl>=3.1,<4" \
        "pandas>=2.2,<3"

COPY server.py .

# Run as a non-root user: skill/report code executed via /exec must NOT run as
# root (defence-in-depth — a compromised or buggy skill can't touch the VM's
# system as root). Pre-create the skill-sync target (/skills) and a writable HOME
# (libreoffice/chromium need one) owned by the app user. Port 8080 is >1024, so no
# privileged bind is required.
RUN useradd --create-home --uid 10001 appuser \
    && mkdir -p /skills \
    && chown -R appuser:appuser /skills /app
ENV HOME=/home/appuser
USER appuser

# Unbuffered stdout so the resumed microVM flushes runtime logs to CloudWatch
# (the snapshot only froze stdout up to build time).
ENV PYTHONUNBUFFERED=1

# The MicroVM ingress connector maps inbound HTTPS to this port.
EXPOSE 8080

# Lambda snapshots the running process; the app must be listening at snapshot time.
CMD ["uvicorn", "server:app", "--host", "0.0.0.0", "--port", "8080", "--log-level", "info"]
