FROM python:3.9-slim-bullseye

# 1) System deps (as root)
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    curl \
    git \
 && rm -rf /var/lib/apt/lists/*

# 2) Create a non-root user for runtime
RUN useradd -m -u 1000 appuser

# 3) App setup
WORKDIR /app
COPY requirements.txt .
RUN pip3 install --no-cache-dir -r requirements.txt
COPY . .

# 4) Make sure the runtime user can write where needed
RUN chown -R appuser:appuser /app /home/appuser

# 5) Streamlit config in a writable home
RUN mkdir -p /home/appuser/.streamlit && \
    printf "[general]\nbrowser.gatherUsageStats = false\n" > /home/appuser/.streamlit/config.toml && \
    chown -R appuser:appuser /home/appuser/.streamlit

# 6) Env for Streamlit + switch to non-root
ENV HOME=/home/appuser
ENV STREAMLIT_CONFIG_DIR=/home/appuser/.streamlit
USER appuser

EXPOSE 8501
HEALTHCHECK CMD curl --fail http://localhost:8501/_stcore/health || exit 1

ENTRYPOINT ["streamlit", "run", "src/streamlit_app.py", "--server.port=8501", "--server.address=0.0.0.0"]