FROM python:3.12-slim

# Non-root by default — the canary only needs outbound network.
RUN useradd --create-home --uid 10001 canary
WORKDIR /app

COPY pyproject.toml README.md ./
COPY src ./src
RUN pip install --no-cache-dir .

USER canary
ENTRYPOINT ["canary"]
CMD ["--help"]
