FROM python:3.12.13-slim-trixie

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PATH="/app/.venv/bin:$PATH"

RUN apt-get update \
    && apt-get install -y --no-install-recommends ca-certificates curl gdal-bin libmagic1 \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd --gid 10001 uas \
    && useradd --uid 10001 --gid 10001 --no-create-home --home-dir /app --shell /usr/sbin/nologin uas

WORKDIR /app
COPY --chown=10001:10001 requirements.lock requirements.in ./
RUN python -m venv /app/.venv \
    && pip install --require-hashes --no-deps -r requirements.lock

COPY --chown=10001:10001 . .
RUN mkdir -p /app/staticfiles /app/media /app/recordings /app/run \
    && chown -R 10001:10001 /app/staticfiles /app/media /app/recordings /app/run \
    && chmod 0755 /app/docker-entrypoint.sh

USER 10001:10001
EXPOSE 8000
ENTRYPOINT ["/app/docker-entrypoint.sh"]
CMD ["web"]
