# Image de backend/ : notebooks marimo, servis en lecture seule.
# Construite depuis la racine du dépôt (compose.yaml, ou podman build -f <dossier>/Containerfile .).
# uv seul, jamais pip ; utilisateur non-root ([CONTENEUR-DURCI]).
FROM ghcr.io/astral-sh/uv:python3.14-bookworm-slim
ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_PYTHON_DOWNLOADS=never PYTHONUNBUFFERED=1
WORKDIR /srv/backend
COPY backend/pyproject.toml backend/uv.lock backend/.python-version ./
RUN uv sync --locked --no-dev --no-install-project
COPY backend/ ./
RUN uv sync --locked --no-dev && useradd --system --create-home app && chown -R app /srv
USER app
EXPOSE 2718
CMD ["uv", "run", "--no-sync", "marimo", "run", "notebooks/exploration.py", "--host", "0.0.0.0", "--port", "2718"]
