# syntax=docker/dockerfile:1

# Stage 1: build the runner into an isolated virtual environment.
# The full image carries the compilers pip may need; none of it ships.
FROM python:3.12-bookworm AS builder

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIP_NO_CACHE_DIR=1

WORKDIR /build

RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

# Package descriptors first so dependency layers cache across source edits.
COPY pyproject.toml README.md LICENSE ./
COPY etalon/ ./etalon
# hatchling force-includes examples/demo-pack as etalon/demo_pack, which is
# what `etalon pack init --from demo` copies out at run time.
COPY examples/demo-pack/ ./examples/demo-pack

RUN pip install .

# Stage 2: runtime. Only the virtual environment is copied over.
FROM python:3.12-slim-bookworm

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PATH="/opt/venv/bin:$PATH"

# Fixed uid/gid so bind-mounted evidence has a predictable owner and the
# image runs under restricted Kubernetes/OpenShift security contexts.
RUN groupadd --gid 10001 etalon \
    && useradd --uid 10001 --gid 10001 --create-home --shell /usr/sbin/nologin etalon \
    && mkdir -p /app/packs /app/evidence \
    && chown -R etalon:etalon /app

# Root-owned and read-only for the runtime user; nothing in it is writable.
COPY --from=builder /opt/venv /opt/venv

WORKDIR /app
USER etalon

# Private packs in, evidence bundles out. Neither is ever baked into a layer.
VOLUME ["/app/packs", "/app/evidence"]

ENTRYPOINT ["etalon"]
CMD ["--help"]
