# Containerfile
#
# Multi-stage offline build.
# vendor/ must be present before building:
#   make vendor          (on a networked machine)
#   podman build --network=none -t offliner:latest .
#
# Stage 1 builds the wheel from source using only vendor/.
# Stage 2 installs the wheel and runtime deps into a minimal image.

# ── Stage 1: build ────────────────────────────────────────────────────────────
FROM python:3.12-slim AS builder

WORKDIR /build

# Copy vendored wheels first (layer-cache friendly — changes less often than src)
COPY vendor/ /build/vendor/

# Copy packaging metadata, then source
COPY pyproject.toml README.md ./
COPY src/ ./src/

# Install the build backend from vendor, then build the project wheel.
# --no-build-isolation: prevents pip from fetching the build backend from PyPI.
# --no-index + --find-links: use only vendor/.
RUN pip install \
        --no-index \
        --find-links=/build/vendor \
        --no-build-isolation \
        hatchling build \
    && python -m build \
        --wheel \
        --no-isolation \
        --outdir /build/dist/

# ── Stage 2: runtime ──────────────────────────────────────────────────────────
FROM python:3.12-slim AS runtime

WORKDIR /app

# Security: run as a non-root user
RUN useradd --no-create-home --shell /bin/false appuser

# Copy the lock file, vendor wheels, and the built application wheel
COPY requirements.txt /app/
COPY --from=builder /build/vendor/ /app/vendor/
COPY --from=builder /build/dist/*.whl /app/wheels/

# Step 1: install runtime deps from vendor/ with hash verification
# Step 2: install the application wheel (no-deps — runtime deps already present)
# Step 3: remove wheel/vendor artifacts from the final image
RUN pip install \
        --no-index \
        --find-links=/app/vendor \
        --require-hashes \
        --no-cache-dir \
        -r /app/requirements.txt \
    && pip install \
        --no-index \
        --find-links=/app/wheels \
        --no-deps \
        --no-cache-dir \
        offliner-py \
    && rm -rf /app/vendor /app/wheels /app/requirements.txt

USER appuser

ENTRYPOINT ["offliner"]
CMD ["--help"]
