# qw-api training container. Pin the base image digest at cohort kickoff
# and record it in architecture/host-baseline.md (W01/D008).
FROM python:3.12-slim

# Non-root runtime user (least privilege; CWE-250 hygiene).
RUN useradd --create-home --uid 10001 appuser
WORKDIR /app

# Install dependencies first for layer caching.
COPY requirements.txt /app/requirements.txt
RUN pip install --no-cache-dir -r /app/requirements.txt

# Copy application source.
COPY . /app

USER appuser
EXPOSE 8000

# Container-internal healthcheck. The host still binds 127.0.0.1 only.
HEALTHCHECK --interval=15s --timeout=3s --retries=5 \
  CMD python -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/health').status==200 else 1)"

CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]
