FROM python:3.12-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    DATABASE_PATH=/app/data/annotation.db \
    CSV_DATA_DIR=/app/csv_data \
    SESSION_COOKIE_SECURE=true \
    SESSION_COOKIE_SAMESITE=None

WORKDIR /app

RUN groupadd --gid 1000 appuser \
    && useradd --uid 1000 --gid 1000 --create-home appuser

COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

COPY app.py models.py csv_utils.py wsgi.py ./
COPY templates ./templates
COPY static ./static
COPY csv_data ./csv_data
COPY annotation.db ./data/annotation.db

RUN chown -R appuser:appuser /app
USER appuser

EXPOSE 7860

CMD ["gunicorn", "--preload", "--workers", "2", "--bind", "0.0.0.0:7860", "--no-control-socket", "--access-logfile", "-", "--error-logfile", "-", "wsgi:app"]