FROM python:3.14-slim

# Copy uv helper binary from the uv image so we can manage venvs and pip
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/

ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1

# Install build deps required for common Python packages and netcat for health wait
RUN apt-get update \
     && apt-get install -y --no-install-recommends \
         build-essential \
         gcc \
         git \
         libpq-dev \
         pkg-config \
         libcairo2-dev \
         # some distributions provide libgdk-pixbuf under the xlib name
         libgdk-pixbuf-xlib-2.0-0 \
         libgdk-pixbuf-xlib-2.0-dev \
         libjpeg-dev \
         zlib1g-dev \
         wget \
         ca-certificates \
         netcat-openbsd \
     && rm -rf /var/lib/apt/lists/*

WORKDIR /usr/src/app

# Install python deps into a uv-managed venv for reproducible builds
COPY requirements.txt /usr/src/app/
# Prebuild wheels into /wheels so compiled artifacts are cached in a layer.
# This speeds rebuilds when `requirements.txt` hasn't changed. The first build
# still needs to compile any packages without prebuilt wheels.
RUN mkdir -p /wheels \
    && python -m venv /tmp/venvbuild \
    && /tmp/venvbuild/bin/pip install --upgrade pip setuptools wheel \
    && /tmp/venvbuild/bin/pip wheel --wheel-dir=/wheels -r requirements.txt \
    && rm -rf /tmp/venvbuild

# Create non-root user before creating the venv so we can install as that
# user and avoid expensive recursive `chown -R` operations on large paths.
RUN useradd -m appuser

# Create the final uv-managed venv inside the app user's home and install
# from the cached wheels where possible. Running the venv creation and
# installation as `appuser` ensures ownership is correct without a later
# recursive chown.
USER appuser
RUN uv venv /home/appuser/.venv \
    && export VIRTUAL_ENV=/home/appuser/.venv \
    && export PATH="/home/appuser/.venv/bin:$PATH" \
    && uv pip install --upgrade pip setuptools wheel \
    && uv pip install --no-index --find-links=/wheels -r requirements.txt

# Ensure the runtime environment uses the uv-managed venv by default.
ENV VIRTUAL_ENV=/home/appuser/.venv
ENV PATH="/home/appuser/.venv/bin:$PATH"

# Switch back to root to copy project files and prepare the log directory.
USER root

# Create directory for application logs and ensure ownership is correct.
# Do this as root before switching to `appuser` so the directory exists and
# can be mounted by the dev compose override.
RUN mkdir -p /var/log/rad \
    && chown -R appuser:appuser /var/log/rad

# Copy project files into image and set ownership during copy (faster than
# a separate `chown -R` step). This keeps layer reuse efficient.
COPY --chown=appuser:appuser . /usr/src/app

# Make the entrypoint executable (some files in the repo may not have the
# executable bit set). Do this as root before switching to the app user.
RUN [ -f /usr/src/app/entrypoint.sh ] && chmod +x /usr/src/app/entrypoint.sh || true
USER appuser

ENTRYPOINT ["/usr/src/app/entrypoint.sh"]