ops(docker): add stdlib healthcheck, OCI labels, and .dockerignore

Dockerfile

@@ -8,7 +8,7 @@ ENV PIP_NO_CACHE_DIR=1 \
 WORKDIR /build
 
 # If you truly need to compile deps, keep build-essential.
-# If you use psycopg[binary], you can usually drop libpq-dev safely.
+# If you use psycopg[binary], you can safely drop libpq-dev.
 RUN apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
   && rm -rf /var/lib/apt/lists/*
@@ -26,7 +26,8 @@ FROM python:3.12-slim AS runtime
 
 ENV PIP_NO_CACHE_DIR=1 \
     PYTHONDONTWRITEBYTECODE=1 \
-    PYTHONUNBUFFERED=1
+    PYTHONUNBUFFERED=1 \
+    PYTHONPATH=/app
 
 WORKDIR /app
 
@@ -44,10 +45,17 @@ RUN pip install --no-cache-dir --find-links=/wheels -r requirements.txt && \
 # Copy the actual application code
 COPY . .
 
-# Optional: healthcheck (needs curl)
-# RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*
-# HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
-#   CMD curl -fsS http://localhost:8000/healthz || exit 1
+# ---------- Metadata & Healthcheck ----------
+LABEL org.opencontainers.image.title="nl2sql-copilot" \
+      org.opencontainers.image.description="Modular Text-to-SQL Copilot (FastAPI)" \
+      org.opencontainers.image.source="https://github.com/melika-kheirieh/nl2sql-copilot" \
+      org.opencontainers.image.authors="melika.kheirieh" \
+      org.opencontainers.image.licenses="MIT"
+
+# Lightweight healthcheck (no curl)
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+  CMD python -c "import urllib.request, sys; \
+  sys.exit(0) if urllib.request.urlopen('http://127.0.0.1:8000/healthz', timeout=2).getcode() == 200 else sys.exit(1)"
 
 # Drop privileges
 USER appuser
@@ -55,5 +63,5 @@ USER appuser
 EXPOSE 8000
 
 # Start FastAPI with Uvicorn
-# Tip: you can tweak workers via env in deployment (e.g., UVICORN_WORKERS=2)
-CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--proxy-headers"]
+# (UVICORN_WORKERS can be overridden at runtime)
+CMD ["sh", "-c", "uvicorn app.main:app --host 0.0.0.0 --port 8000 --proxy-headers --workers ${UVICORN_WORKERS:-1}"]