FROM python:3.11-slim

WORKDIR /app

# Playwright saves browsers here during the image build. The same path is then
# available to the non-root FastAPI process at runtime.
ENV PYTHONUNBUFFERED=1 \
    PORT=7860 \
    PLAYWRIGHT_BROWSERS_PATH=/ms-playwright

# Install the application dependencies first so Docker can cache this layer.
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt \
    && python -m playwright install --with-deps chromium \
    && rm -rf /var/lib/apt/lists/* /root/.cache/pip

# Copy the FastAPI application after dependency installation.
COPY . ./

# Avoid running the web app as root. The installed browser path is readable by
# this user and /tmp remains writable for temporary MP4 output.
RUN useradd --create-home --uid 1000 appuser \
    && chown -R appuser:appuser /app /ms-playwright
USER appuser

EXPOSE 7860

# Uses $PORT when a host injects it, and otherwise listens on 7860.
CMD ["sh", "-c", "uvicorn app:app --host 0.0.0.0 --port ${PORT:-7860}"]