# Gentleman user image — customize and build your own

# build
FROM ghcr.io/astral-sh/uv:python3.14-bookworm-slim AS builder

WORKDIR /app

ENV UV_COMPILE_BYTECODE=1 \
    UV_LINK_MODE=copy \
    UV_PYTHON_DOWNLOADS=never

COPY pyproject.toml uv.loc[k] ./

RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --no-install-workspace --no-dev

RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --no-dev --no-editable

# deploy
FROM python:3.14-slim-bookworm
WORKDIR /app

# os: pick up security updates published after the base image was built
RUN apt-get update \
 && apt-get upgrade -y --no-install-recommends \
 && rm -rf /var/lib/apt/lists/*

# python: the app runs from /app/.venv; pip (and the libraries it vendors)
# is not used at runtime
RUN python -m pip uninstall -y pip

# uv
COPY --from=builder /usr/local/bin/uv /usr/local/bin/uvx /usr/local/bin/
RUN uvx --version

# node: npx is needed for stdio MCP servers; corepack is not
COPY --from=node:24-bookworm-slim /usr/local/bin/node /usr/local/bin/node
COPY --from=node:24-bookworm-slim /usr/local/lib/node_modules /usr/local/lib/node_modules
RUN rm -rf /usr/local/lib/node_modules/corepack \
 && ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
 && ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \
 && npm install -g npm@latest \
 && npm cache clean --force \
 && node --version && npm --version

# Fixed uid/gid 1000, matching the Helm chart's runAsUser/runAsGroup.
RUN groupadd -r -g 1000 gentleman \
 && useradd -r -u 1000 -g gentleman -m -d /home/gentleman gentleman

COPY --from=builder --chown=gentleman:gentleman /app/.venv /app/.venv

# Mount agents/ at /app/agents/ (see compose.yaml for an example).
# If your environment cannot mount files, you may bake it into the image
# instead — but do not include credentials in it.

# COPY agents/ /app/agents/

ENV PATH="/app/.venv/bin:$PATH" \
    GENTLEMAN_APP_AGENTS_DIR=/app/agents \
    HOME=/home/gentleman \
    NPM_CONFIG_CACHE=/home/gentleman/.npm \
    NPM_CONFIG_UPDATE_NOTIFIER=false \
    NPM_CONFIG_FUND=false \
    UV_CACHE_DIR=/home/gentleman/.cache/uv \
    UV_PYTHON_INSTALL_DIR=/home/gentleman/.local/share/uv/python

# Numeric, so that runAsNonRoot can be verified without resolving the name.
USER 1000:1000
EXPOSE 8000

ENTRYPOINT ["uvicorn", "gentleman:app"]
CMD ["--host", "0.0.0.0", "--port", "8000"]
