FROM python:3.11-slim

ENV DEBIAN_FRONTEND=noninteractive
ENV PYTHONUNBUFFERED=1
ENV PYTHONPATH=/app

# System dependencies for building and common libraries
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential gcc \
    libjpeg-dev zlib1g-dev libpng-dev \
    libssl-dev libffi-dev \
    && rm -rf /var/lib/apt/lists/*

# Create a non-root user for running the app
RUN useradd -m appuser

WORKDIR /app

# Install Python dependencies first (takes advantage of Docker layer caching)
COPY requirements.txt /app/requirements.txt
RUN pip install --no-cache-dir -r requirements.txt || true

# Copy the repository contents
COPY . /app

# Install the package if a setup.py is present (safe no-op if not)
RUN if [ -f setup.py ]; then pip install --no-cache-dir .; fi

# Bring in the entrypoint script and ensure it is executable
COPY docker_entrypoint.sh /usr/local/bin/entrypoint.sh
RUN chmod +x /usr/local/bin/entrypoint.sh

# Ensure the app directory is owned by the non-root user
RUN chown -R appuser:appuser /app

USER appuser

ENV PYTHONPATH=/app

# Default command: run a shell so the container can be inspected, entrypoint handles smoke test
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
CMD ["bash"]