FROM python:3.14-slim AS builder

ENV UV_LINK_MODE=copy \
    UV_COMPILE_BYTECODE=1 \
    UV_PROJECT_ENVIRONMENT=/app/.venv

RUN apt-get update && apt-get install -y --no-install-recommends curl ca-certificates && rm -rf /var/lib/apt/lists/*
COPY --from=ghcr.io/astral-sh/uv:0.5 /uv /uvx /usr/local/bin/

WORKDIR /app
COPY pyproject.toml uv.lock ./
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --no-dev --no-install-project
COPY monlet_server ./monlet_server
COPY alembic.ini ./
COPY alembic ./alembic
RUN --mount=type=cache,target=/root/.cache/uv uv sync --frozen --no-dev


FROM python:3.14-slim
ENV PATH="/app/.venv/bin:$PATH" \
    PYTHONUNBUFFERED=1

# PH-015: non-root runtime user. UID/GID are stable so bind-mounts can be
# pre-chowned by operators if they need writable host paths.
RUN groupadd --system --gid 1000 monlet \
    && useradd --system --uid 1000 --gid monlet --home-dir /app --shell /usr/sbin/nologin monlet

WORKDIR /app
COPY --from=builder /app /app
RUN chown -R monlet:monlet /app

USER monlet:monlet
EXPOSE 8000
STOPSIGNAL SIGTERM
CMD ["uvicorn", "monlet_server.main:app", "--host", "0.0.0.0", "--port", "8000"]