FROM python:3.11-slim

RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*

# HF Spaces runs containers as a non-root user (UID 1000). Create it so runtime
# writes (jobs/, data/, .geocode_cache.json, state.json) don't hit permission
# errors. Local `docker compose up` works the same way.
RUN useradd -m -u 1000 user
ENV HOME=/home/user

WORKDIR /app

COPY requirements.txt requirements-web.txt ./
RUN pip install --no-cache-dir -r requirements.txt -r requirements-web.txt

COPY . .

# Writable working dirs + executable entrypoint, all owned by the runtime user.
RUN mkdir -p jobs data && chmod +x docker-entrypoint.sh && chown -R user:user /app

USER user

EXPOSE 8000

ENTRYPOINT ["./docker-entrypoint.sh"]