# Stage 1: base image with system deps (rarely changes)
FROM python:3.11-slim AS base

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

RUN groupadd -r iobj && useradd -r -g iobj -m iobj
WORKDIR /app
RUN mkdir -p /app/data && chown -R iobj:iobj /app

# Copy requirements first for pip layer caching
COPY requirements.txt ./
RUN pip install --no-cache-dir --upgrade pip \
    && pip install --no-cache-dir -r requirements.txt

# Copy application code last (rebuilds only when code changes)
COPY iobj/ ./iobj/
COPY README.md ./

RUN chown -R iobj:iobj /app
USER iobj

ENV IOBJ_DATA_DIR=/app/data

# Health check — dynamic port support for Nomad (no curl/apt-get needed)
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD python -c "import os,urllib.request,sys; \
    urllib.request.urlopen(f'http://localhost:{os.environ.get(\"PORT\",\"8000\")}/health', timeout=5)" || exit 1

EXPOSE 8000

CMD ["sh", "-c", "uvicorn iobj.app:app --host 0.0.0.0 --port ${PORT:-8000}"]

LABEL name="iObj" \
      description="Personal JSON object / memory bank service" \
      version="0.1.0"