FROM python:3.13-slim

WORKDIR /app

RUN apt-get update -y \
    && apt-get install -y --no-install-recommends build-essential \
    && rm -rf /var/lib/apt/lists/*

RUN pip install --upgrade pip

# Install CPU-only PyTorch first (skips ~3GB of NVIDIA/CUDA dependencies)
RUN pip install --no-cache-dir torch --index-url https://download.pytorch.org/whl/cpu

COPY containers/eugene_ws/requirements.txt /app/
# Install remaining deps; torch is already satisfied so CUDA variant is skipped
RUN pip install --no-cache-dir -r requirements.txt

# Stage 1 hardening extras: rate limiting, structured logging
RUN pip install --no-cache-dir \
    "slowapi==0.1.9" \
    "python-json-logger==2.0.7"

COPY src /app/src

RUN useradd -ms /bin/sh eugene
ENV HOME=/home/eugene
RUN mkdir -p /home/eugene/.cache/huggingface/hub \
    && chown -R eugene:eugene /app /home/eugene

USER eugene

EXPOSE 8000

CMD ["uvicorn", "eugene_ws:app", "--app-dir", "src", "--host", "0.0.0.0", "--port", "8000"]
