FROM python:3.11-slim

RUN pip install --no-cache-dir mitmproxy

RUN useradd -m -u 1000 user
USER user
ENV HOME=/home/user \
    PATH=/home/user/.local/bin:$PATH

WORKDIR $HOME/app

EXPOSE 7860

# Version 11+ fix: mitmweb now uses 'web_password' for a fixed secret
# and handles the domain logic better via the web_host/port flags.
CMD sh -c "mitmweb \
    --web-host 0.0.0.0 \
    --web-port 7860 \
    --set block_global=false \
    --set web_open_browser=false \
    --set web_user=${MITM_USER:-admin} \
    --set web_password=${MITM_PASS:-password123}"