FROM python:3.12-slim@sha256:a0f57064cbdcd6285fa45f51237ab0b35ea8ebaed06a1f5973e89e19dfb86704

# Google Chrome is available for amd64, while Debian Chromium makes the same solver portable to arm64 development hosts.
# Query the installed architecture inside the image: classic Docker builds do not populate BuildKit's TARGETARCH argument.
# Docker's default seccomp profile prevents Chromium's namespace sandbox in this container configuration.
# The solver therefore runs Chrome without that sandbox as a dedicated non-root user with runtime confinement.
# Every documented launch drops all capabilities and prohibits new privileges.
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates fonts-liberation wget xvfb \
    && if [ "$(dpkg --print-architecture)" = "amd64" ]; then \
        wget -q -O /tmp/google-chrome.deb https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_156.0.8078.47-1_amd64.deb \
        && echo "6c92cd22e90c6e3e255d782991543fa2091db8614e8536a971a7433a5c4d7ac8  /tmp/google-chrome.deb" | sha256sum --check --status \
        && apt-get install -y --no-install-recommends /tmp/google-chrome.deb; \
    else \
        apt-get install -y --no-install-recommends chromium chromium-driver \
        && ln -s /usr/bin/chromium /usr/local/bin/google-chrome; \
    fi

RUN python -m pip install --no-cache-dir Flask==3.1.3 seleniumbase==4.56.2
# SeleniumBase creates and patches its UC driver in this cache at browser startup, so only that directory is writable by the non-root solver.
RUN groupadd --system funisolver \
    && useradd --system --create-home --gid funisolver funisolver \
    && chown funisolver:funisolver /usr/local/lib/python3.12/site-packages/seleniumbase/drivers \
    && install --directory --owner=funisolver --group=funisolver /app

WORKDIR /app
COPY --chown=funisolver:funisolver solver.py /app/solver.py

ENV HOME=/home/funisolver
USER funisolver
EXPOSE 8194
CMD ["python", "/app/solver.py"]
