# Two-stage-ish build: the browser is the heavy part, so it lives behind an
# arg. `docker build --build-arg WITH_JS=1` produces an image that can render
# client-side sites; the default stays small for the static path.
FROM python:3.12-slim

ARG WITH_JS=0

# PLAYWRIGHT_BROWSERS_PATH matters: Chromium is installed as root but run as an
# unprivileged user, and the default location is /root/.cache, which that user
# cannot read. The failure would only show up at runtime, on the first render.
ENV PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    SCRAPEWRIGHT_DB=/data/scrapewright_service.db \
    SCRAPEWRIGHT_CACHE=/data/recipes.json \
    PLAYWRIGHT_BROWSERS_PATH=/ms-playwright

WORKDIR /app
COPY pyproject.toml README.md LICENSE ./
COPY scrapewright ./scrapewright

RUN pip install --no-cache-dir ".[service,llm,excel,stripe,mcp]" \
 && if [ "$WITH_JS" = "1" ]; then \
      pip install --no-cache-dir ".[js]" \
      && playwright install --with-deps chromium \
      && chmod -R a+rX "$PLAYWRIGHT_BROWSERS_PATH"; \
    fi

# Usage data outlives the container.
VOLUME ["/data"]
RUN mkdir -p /data

# Run unprivileged: this process fetches attacker-controlled pages.
RUN useradd --create-home --uid 10001 scrapewright && chown -R scrapewright /data
USER scrapewright

EXPOSE 8000
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
  CMD python -c "import urllib.request;urllib.request.urlopen('http://127.0.0.1:8000/health')"

CMD ["scrapewright", "serve", "--host", "0.0.0.0", "--port", "8000"]
