# syntax=docker/dockerfile:1
#
# Production image for the ungleich account webapp.
# All configuration comes from environment variables (see env.sample).
#
#   docker build -t ungleich-user .
#   docker run --env-file .env -p 8000:8000 ungleich-user
#
# Database migrations are not run on start; run them once per release:
#   docker run --env-file .env ungleich-user python manage.py migrate

FROM python:3.15-slim-trixie

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1

# Security updates for the base image. No sshd or compiler is installed:
# every Python dependency ships as a pure Python or binary wheel.
RUN apt-get update \
    && apt-get upgrade -y --no-install-recommends \
    && rm -rf /var/lib/apt/lists/* \
    && useradd --system --uid 10001 --no-create-home --home-dir /app app

WORKDIR /app

COPY requirements.txt .
RUN pip install -r requirements.txt

COPY manage.py gunicorn.conf.py ./
COPY dal ./dal

# Settings need placeholder values to load. The dev env file is mounted
# for this one command only and is not stored in the image.
RUN --mount=type=bind,source=dev/env.dev,target=/app/.env \
    python manage.py collectstatic --noinput -v0

USER 10001
EXPOSE 8000

CMD ["gunicorn", "dal.wsgi:application"]