# Stage 1 - build dependencies
FROM python:3.11-slim AS builder
ENV PYTHONUNBUFFERED=1 PIP_NO_CACHE_DIR=1
WORKDIR /app

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
       build-essential \
       gcc \
       pkg-config \
       default-libmysqlclient-dev \
       libmariadb-dev-compat \
       libssl-dev \
       libpq-dev \
    && rm -rf /var/lib/apt/lists/*

COPY backend/requirements.txt /tmp/requirements.txt
RUN pip install --upgrade pip setuptools wheel \
    && pip install -r /tmp/requirements.txt

# Stage 2 - runtime
FROM python:3.11-slim
ENV PYTHONUNBUFFERED=1
WORKDIR /app

# Create non-root user
RUN adduser --disabled-password --gecos "" sirus

COPY --from=builder /usr/local/bin /usr/local/bin
COPY --from=builder /usr/local/lib/python3.11/site-packages /usr/local/lib/python3.11/site-packages
COPY backend /app/backend
ENV PYTHONPATH=/app

RUN chown -R sirus:sirus /app
USER sirus

HEALTHCHECK --interval=10s --timeout=3s --retries=5 \
    CMD ["python", "-c", "import requests; requests.get('http://localhost:5559/health')"]

CMD ["uvicorn", "backend.SQL_Agent.agent:app", "--host", "0.0.0.0", "--port", "5559", "--log-level", "info"]