Dockerfile

# syntax=docker/dockerfile:1

# ── Stage 1: builder ──────────────────────────────────────────────────────────
# Resolve and install the locked dependency set into a self-contained virtualenv
# using uv. Nothing from this stage except /app/.venv reaches the final image.
FROM python:3.12-slim AS builder

# Pinned uv release (never :latest) — copied as a static binary, no pip needed.
COPY --from=ghcr.io/astral-sh/uv:0.10.6 /uv /uvx /usr/local/bin/

ENV UV_COMPILE_BYTECODE=1 \
    UV_LINK_MODE=copy \
    UV_PYTHON_DOWNLOADS=0

WORKDIR /app

# Install ONLY dependencies first (no project source) so this layer is cached
# and reused across code changes. Requires pyproject.toml + uv.lock at repo root
# (owned by the CORE agent).
COPY pyproject.toml uv.lock ./
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --locked --no-install-project --no-dev

# ── Stage 2: runtime ──────────────────────────────────────────────────────────
FROM python:3.12-slim AS runtime

# curl is required by the HEALTHCHECK below; libpq for asyncpg/psycopg runtime.
RUN apt-get update \
    && apt-get install -y --no-install-recommends curl libpq5 \
    && rm -rf /var/lib/apt/lists/*

# Non-root user — never run the app as root.
RUN groupadd --gid 1000 app \
    && useradd --uid 1000 --gid 1000 --create-home --shell /usr/sbin/nologin app

ENV PATH="/app/.venv/bin:$PATH" \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    LOG_LEVEL=INFO

WORKDIR /app

# Bring the fully-resolved virtualenv from the builder stage.
COPY --from=builder --chown=app:app /app/.venv /app/.venv

# Application source. .dockerignore keeps .env, tests/, frontend/, caches, and
# data artifacts out of the image (see .dockerignore).
COPY --chown=app:app . .

USER app

EXPOSE 8000

# Liveness probe used by Docker / compose; /health must return 200 when alive.
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
    CMD curl -fsS http://localhost:8000/health || exit 1

# Default command = API. The compose worker service overrides this with
# `python -m worker.processor`; the SAME image serves both roles.
CMD ["uvicorn", "api.main:app", "--host", "0.0.0.0", "--port", "8000"]