FROM ghcr.io/astral-sh/uv:0.12.5 AS uv
FROM node:24-bookworm-slim AS node
FROM docker:28-cli AS docker-cli

FROM python:3.12-slim-bookworm AS runtime
ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    UV_LINK_MODE=copy
WORKDIR /app

# Keep the npm, PyPI, and Docker launchers used by registry introspection.
# The Docker daemon, if needed, is supplied by the deployment separately.
COPY --from=uv /uv /uvx /usr/local/bin/
COPY --from=node /usr/local/bin/node /usr/local/bin/node
COPY --from=node /usr/local/lib/node_modules/npm /usr/local/lib/node_modules/npm
COPY --from=docker-cli /usr/local/bin/docker /usr/local/bin/docker
RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
    && ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx

COPY wheels /tmp/wheels
RUN uv pip install --system --no-cache --constraint /tmp/wheels/constraints.txt /tmp/wheels/*.whl \
    && rm -rf /tmp/wheels \
    && node --version && npx --version && uv --version && uvx --version && docker --version

COPY space_app.py index.html /app/
RUN useradd --create-home --uid 1000 app
USER 1000
WORKDIR /home/app
ENV UV_CACHE_DIR=/home/app/.cache/uv NPM_CONFIG_CACHE=/home/app/.npm
EXPOSE 8000
# Supply DATABASE_URL for durable PostgreSQL storage. Without it the registry
# uses ephemeral storage. Set PURECIPHER_SIGNING_SECRET at deployment time.
CMD ["python", "/app/space_app.py"]