# ---------- Stufe 1: Abhängigkeiten ----------
FROM registry.access.redhat.com/ubi9/python-312:latest AS builder

WORKDIR /build
COPY requirements.txt .
RUN pip install --no-cache-dir --target=/build/deps -r requirements.txt

# ---------- Stufe 2: Laufzeit ----------
FROM registry.access.redhat.com/ubi9/python-312-minimal:latest

LABEL org.opencontainers.image.title="KFZ-Rechner" \
      org.opencontainers.image.vendor="Beispiel AG"

WORKDIR /app
COPY --from=builder /build/deps /app/deps
COPY src/ ./src/

ENV PYTHONPATH=/app/deps \
    PYTHONUNBUFFERED=1 \
    LOG_LEVEL=INFO

# Gruppe 0 statt fester UID -> läuft auch unter OpenShift
RUN chgrp -R 0 /app && chmod -R g=u /app
USER 1001

EXPOSE 8080

HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
  CMD python -c "import urllib.request,sys; \
      sys.exit(0 if urllib.request.urlopen('http://localhost:8080/health').status==200 else 1)"

CMD ["python", "-m", "src.server"]