# syntax=docker/dockerfile:1
# ---------------------------------------------------------------------------
# Portfolio Platform — multi-stage production image.
# Stage 1 builds a wheel of the package + deps into a venv; stage 2 is a slim
# runtime that copies only the venv and source — no build toolchain in the final
# image (smaller attack surface, faster pulls). Runs as a non-root user.
# ---------------------------------------------------------------------------
FROM python:3.12-slim AS builder

ENV PIP_NO_CACHE_DIR=1 PYTHONDONTWRITEBYTECODE=1
WORKDIR /build

COPY pyproject.toml README.md ./
COPY src ./src

# Optional extras are opt-in via a build arg so the default image stays lean and
# boots anywhere (the API runs fully on the core deps in memory mode). Build the
# full integration image with:  docker build --build-arg EXTRAS="[agents,messaging,observability]" .
ARG EXTRAS=""
RUN python -m venv /opt/venv \
    && /opt/venv/bin/pip install --upgrade pip \
    && /opt/venv/bin/pip install ".${EXTRAS}"

# ---------------------------------------------------------------------------
FROM python:3.12-slim AS runtime

ENV PATH="/opt/venv/bin:$PATH" \
    PYTHONUNBUFFERED=1 \
    PP_ENVIRONMENT=prod

# Non-root runtime user.
RUN useradd --create-home --uid 10001 appuser
WORKDIR /app

COPY --from=builder /opt/venv /opt/venv
COPY --from=builder /build/src /app/src
ENV PYTHONPATH=/app/src

USER appuser
EXPOSE 8000

# Liveness is the /health endpoint.
HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
    CMD python -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8000/health').status==200 else 1)"

CMD ["uvicorn", "portfolio_platform.apps.api.main:create_app", "--factory", \
     "--host", "0.0.0.0", "--port", "8000"]
