# Build context is kept small by .dockerignore.
#
# Dependencies are installed from a hash-pinned export of uv.lock, generated by
# scripts/build-service.sh in the ecosystem root. A bare `pip install <src>`
# resolves versions from PyPI at build time, which is how running images drifted
# past their own lockfile (measured: 15 of 23 packages on kryten-moderator).
FROM python:3.12

WORKDIR /app

RUN apt-get update \
    && apt-get install -y --no-install-recommends build-essential ffmpeg curl \
    && rm -rf /var/lib/apt/lists/* \
    && useradd --system --create-home --uid 1001 kryten

COPY pyproject.toml uv.lock README.md requirements.lock.txt /tmp/kryten-webqueue/
COPY kryten_webqueue /tmp/kryten-webqueue/kryten_webqueue

RUN pip install --no-cache-dir --upgrade pip \
    && pip install --no-cache-dir --require-hashes -r /tmp/kryten-webqueue/requirements.lock.txt \
    && pip install --no-cache-dir --no-deps /tmp/kryten-webqueue

# Fail the build rather than the deploy if the entry point is broken.
RUN python -c "import kryten_webqueue; print('kryten_webqueue', getattr(kryten_webqueue, '__version__', '?'))"

RUN mkdir -p /etc/kryten-webqueue /var/lib/kryten-webqueue /var/log/kryten-webqueue \
    && chown -R kryten:kryten /etc/kryten-webqueue /var/lib/kryten-webqueue /var/log/kryten-webqueue

EXPOSE 2010

USER kryten

ENTRYPOINT ["kryten-webqueue"]
CMD ["--config", "/etc/kryten/kryten-webqueue/config.json"]
