FROM registry.bstein.dev/bstein/python:3.12-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

WORKDIR /app

RUN apt-get update && \
    apt-get install -y --no-install-recommends curl ca-certificates && \
    rm -rf /var/lib/apt/lists/*

COPY backend/requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt && \
    addgroup --system portal && \
    adduser --system --ingroup portal --home /app portal && \
    chown -R portal:portal /app

COPY --chown=portal:portal backend/ .

EXPOSE 8080
USER portal
CMD ["gunicorn", "-b", "0.0.0.0:8080", "app:app"]