# syntax=docker/dockerfile:1
FROM debian:bookworm-slim AS build
COPY --from=ghcr.io/astral-sh/uv:{{ cookiecutter.build_version }} /uv /usr/local/bin/uv
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates build-essential
ENV UV_PYTHON_INSTALL_DIR=/opt/python UV_LINK_MODE=copy UV_COMPILE_BYTECODE=1
WORKDIR /app
COPY . .
# Python 版本只从项目 .python-version 读取；PyPI 或 vendor wheel 均由 uv.lock 固定。
RUN uv python install && uv sync --locked --no-default-groups --no-editable

FROM debian:bookworm-slim AS runtime
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates libstdc++6 && useradd --create-home app
COPY --from=build /opt/python /opt/python
COPY --from=build /app/.venv /app/.venv
COPY --from=build /app/pyproject.toml /app/
WORKDIR /app
ENV PATH="/app/.venv/bin:$PATH" {{ cookiecutter.host_environment_variable }}=production PYTHONUNBUFFERED=1
RUN mkdir /app/.python-ddd-framework && chown app:app /app/.python-ddd-framework
USER app
EXPOSE 8000
# 独立 access handler 会绕过安全 formatter；请求诊断由框架审计和追踪负责。
CMD ["python", "-m", "host.main"]
