FROM python:3.10-slim-bullseye

# 1) System dependencies (minimal)
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    curl \
    git \
 && rm -rf /var/lib/apt/lists/*

# 2) Create non-root user
RUN useradd -m -u 1000 appuser

# 3) App setup
WORKDIR /app
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt
COPY . .

# 4) Permissions
RUN chown -R appuser:appuser /app /home/appuser

# 5) Streamlit config
RUN mkdir -p /home/appuser/.streamlit && \
    printf "[general]\nemail = \"\"\n" > /home/appuser/.streamlit/credentials.toml && \
    printf "[server]\nheadless = true\nenableCORS = false\n" > /home/appuser/.streamlit/config.toml && \
    chown -R appuser:appuser /home/appuser/.streamlit

# 6) Environment variables & non-root
ENV HOME=/home/appuser
ENV STREAMLIT_CONFIG_DIR=/home/appuser/.streamlit
USER appuser

EXPOSE 8501
HEALTHCHECK CMD curl --fail http://localhost:8501/_stcore/health || exit 1

# 7) Run Streamlit app
ENTRYPOINT ["streamlit", "run", "app.py", "--server.port=8501", "--server.address=0.0.0.0"]