FROM python:3.12-slim

ENV PLAYWRIGHT_BROWSERS_PATH=/opt/pw-browsers
WORKDIR /app

RUN apt-get update && apt-get install -y --no-install-recommends \
    curl gettext-base nginx \
    && rm -rf /var/lib/apt/lists/*

RUN pip install --no-cache-dir --upgrade pip \
    && pip install --no-cache-dir "magentic_ui>=0.2.0"

# Chromium + its OS-level deps, for the (unsandboxed) local browser path.
RUN playwright install --with-deps chromium

# Build-time source patch: strengthen the orchestrator's system prompt so
# "go to <url>" tasks always delegate to the browsing agent instead of
# occasionally being shortcut through `bash curl`.
COPY patches/ /app/patches/
RUN python3 /app/patches/apply_patches.py

# Run as non-root: Chromium refuses to launch as root without --no-sandbox,
# which magentic-ui's local browser path doesn't pass.
RUN useradd -m -u 1000 appuser \
    && chown -R appuser:appuser /opt/pw-browsers /app /var/lib/nginx /var/log/nginx

COPY --chown=appuser:appuser config.template.yaml /app/config.template.yaml
COPY --chown=appuser:appuser nginx.conf /app/nginx.conf
COPY --chown=appuser:appuser start.sh /app/start.sh
RUN chmod +x /app/start.sh

USER appuser
ENV HOME=/home/appuser

EXPOSE 7860

CMD ["/app/start.sh"]