build: optimize Dockerfile and ignore configs (.gitignore, .dockerignore)

.dockerignore

@@ -0,0 +1,20 @@
+.git
+.gitignore
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+*.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.venv/
+.env
+.env.*
+data/
+benchmarks/data/
+dist/
+build/
+.wheels/
+*.sqlite
+*.db
+tests/

.gitignore

@@ -1,6 +1,46 @@
-.env
+# --- Python basics ---
 __pycache__/
+*.py[cod]
+*.pyo
+*.pyd
+*.so
+
+# --- Virtual environments ---
 .venv/
+env/
+venv/
+
+# --- IDEs & OS ---
 .idea/
+.vscode/
 .DS_Store
+
+# --- Environment & secrets ---
+.env
+.env.*
+*.key
+*.pem
+
+# --- Test & lint caches ---
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+
+# --- Build & packaging ---
+build/
+dist/
+*.egg-info/
+.wheels/
+
+# --- Data & databases ---
 data/
+*.sqlite
+*.db
+
+# --- Logs & temp files ---
+logs/
+*.log
+tmp/
+*.tmp

Dockerfile

@@ -1,15 +1,19 @@
 # ---------- Stage 1: Build wheels ----------
 FROM python:3.12-slim AS builder
 
-# Set working directory for the build stage
+ENV PIP_NO_CACHE_DIR=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
+
 WORKDIR /build
 
-# Install system dependencies required to compile some Python packages
+# If you truly need to compile deps, keep build-essential.
+# If you use psycopg[binary], you can usually drop libpq-dev safely.
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    build-essential libpq-dev && \
-    rm -rf /var/lib/apt/lists/*
+    build-essential \
+  && rm -rf /var/lib/apt/lists/*
 
-# Copy only requirements first (so Docker caching works efficiently)
+# Leverage Docker layer caching
 COPY requirements.txt .
 
 # Build all dependencies as wheel files inside /wheels
@@ -20,21 +24,36 @@ RUN pip install --upgrade pip && \
 # ---------- Stage 2: Runtime image ----------
 FROM python:3.12-slim AS runtime
 
-# Set working directory for the application
+ENV PIP_NO_CACHE_DIR=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
+
 WORKDIR /app
 
+# Create a non-root user (security best practice)
+RUN useradd -m appuser
+
 # Copy prebuilt wheels from the builder stage
 COPY --from=builder /wheels /wheels
 
-# Install dependencies from prebuilt wheels (no need to compile again)
+# Install dependencies from wheels
 COPY requirements.txt .
-RUN pip install --no-cache-dir --find-links=/wheels -r requirements.txt
+RUN pip install --no-cache-dir --find-links=/wheels -r requirements.txt && \
+    rm -rf /wheels
 
 # Copy the actual application code
 COPY . .
 
-# Expose the FastAPI port
+# Optional: healthcheck (needs curl)
+# RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*
+# HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+#   CMD curl -fsS http://localhost:8000/healthz || exit 1
+
+# Drop privileges
+USER appuser
+
 EXPOSE 8000
 
 # Start FastAPI with Uvicorn
+# Tip: you can tweak workers via env in deployment (e.g., UVICORN_WORKERS=2)
 CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--proxy-headers"]