# S0 minimal backend Dockerfile (OPS-25: pinned, not latest)
FROM python:3.14.3-slim-bookworm

WORKDIR /app

# system deps minimal
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

COPY backend/requirements.txt /app/requirements.txt
RUN pip install --no-cache-dir --upgrade pip && \
    pip install --no-cache-dir -r /app/requirements.txt

COPY backend/ /app/backend/
COPY .dockerignore /app/.dockerignore 2>/dev/null || true

ENV PYTHONPATH=/app \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

# non-root? later; for S0 root ok
EXPOSE 8000

CMD ["uvicorn", "backend.app:app", "--host", "0.0.0.0", "--port", "8000", "--log-level", "info"]