Dockerfile

# ══════════════════════════════════════════════════════════════════
# STAGE 1: builder
# Installs system dependencies for compilation and builds Python packages.
# build-essential and libpq-dev do NOT end up in the final image.
# ══════════════════════════════════════════════════════════════════
FROM python:3.13.12-slim AS builder

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_NO_CACHE_DIR=off \
    PIP_DISABLE_PIP_VERSION_CHECK=on

WORKDIR /app

# System dependencies required ONLY for build (asyncpg compiles a C extension)
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    libpq-dev \
    && rm -rf /var/lib/apt/lists/*

# Dependencies first — layer is cached when requirements.txt is unchanged
# Create user HERE, but do not chown folders that will be mounted
RUN groupadd -r appuser && useradd -r -g appuser appuser

# Create media directories.
# If mounted via docker-compose, chown in Dockerfile will be overridden by host permissions.
RUN mkdir -p /app/logs /app/assets/images /tmp/optifood_media
#    chown -R appuser:appuser /app /tmp/optifood_media
# Dependencies only first (for layer caching)
COPY requirements.txt .
RUN pip install --no-cache-dir --upgrade pip && \
    pip install --no-cache-dir -r requirements.txt

# Download NLTK data at build time (not at runtime)
RUN python -m nltk.downloader wordnet omw-1.4 -d /usr/local/share/nltk_data


# ══════════════════════════════════════════════════════════════════
# STAGE 2: runtime
# Clean slim image without build-essential.
# Only installed packages and code are copied — no build artifacts.
# Smaller image size → smaller attack surface in production.
# ══════════════════════════════════════════════════════════════════
FROM python:3.13.12-slim AS runtime

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    NLTK_DATA=/usr/local/share/nltk_data

WORKDIR /app

# Runtime dependency asyncpg requires libpq (without build-essential)
RUN apt-get update && apt-get install -y --no-install-recommends \
    libpq5 \
    && rm -rf /var/lib/apt/lists/*

# Non-root user
RUN groupadd -r appuser && useradd -r -g appuser appuser

# Copy installed Python packages from builder stage
COPY --from=builder /usr/local/lib/python3.13.12/site-packages /usr/local/lib/python3.13.12/site-packages
COPY --from=builder /usr/local/bin /usr/local/bin
COPY --from=builder /usr/local/share/nltk_data /usr/local/share/nltk_data

# Create directories and copy application code
RUN mkdir -p /app/logs /app/assets/images /tmp/optifood_media

COPY . .

RUN chown -R appuser:appuser /app /tmp/optifood_media /app/logs

USER appuser

CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]