FROM python:3.12-slim
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY main.py update_service.py manage.py ./
# Uploaded ZIP files may have owner-only permissions. Keep code root-owned
# while making it readable to the unprivileged runtime user.
RUN chmod 0755 /app \
    && chmod 0644 /app/requirements.txt /app/main.py /app/update_service.py /app/manage.py \
    && useradd --system --uid 10001 --create-home updates \
    && mkdir -p /app/data && chown updates:updates /app/data
USER updates
EXPOSE 8000
CMD ["python", "-m", "uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "1", "--proxy-headers", "--forwarded-allow-ips", "*", "--no-access-log", "--limit-concurrency", "32", "--timeout-keep-alive", "5"]