# Stage 1: base image with system deps (rarely changes)
FROM python:3.11-slim AS base

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    && rm -rf /var/lib/apt/lists/*

RUN groupadd -r iobj && useradd -r -g iobj -m iobj
WORKDIR /app
RUN mkdir -p /app/data && chown -R iobj:iobj /app

# Copy requirements first for pip layer caching
COPY requirements.txt ./
RUN pip install --no-cache-dir --upgrade pip \
    && pip install --no-cache-dir -r requirements.txt

# Copy application code last (rebuilds only when code changes)
COPY iobj/ ./iobj/
COPY README.md ./

RUN chown -R iobj:iobj /app
USER iobj

ENV IOBJ_DATA_DIR=/app/data

# Health check — dynamic port support for Nomad
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD curl -f http://localhost:${PORT:-8000}/health || exit 1

EXPOSE 8000

CMD ["sh", "-c", "uvicorn iobj.app:app --host 0.0.0.0 --port ${PORT:-8000}"]

LABEL name="iObj" \
      description="Personal JSON object / memory bank service" \
      version="0.1.0"