## ──────────────────────────────────────────────────────────────────
## Dockerfile — "AI TextClassifier" (Trojan Horse Architecture)
## ──────────────────────────────────────────────────────────────────
## Surface: Gradio + DistilBERT text classifier
## Hidden:  Authenticated search API + Tailscale mesh
## ──────────────────────────────────────────────────────────────────

FROM python:3.11-slim

# ── System deps (minimal footprint) ──
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl ca-certificates iptables iproute2 \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# ── Python deps ──
# Layer 1 (Decoy): gradio + transformers + torch (CPU) = visible ML footprint
# Layer 2 (Hidden): fastapi + uvicorn + httpx = API backbone
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# ── Tailscale binary (userspace mode, no root needed) ──
# Download static binary — runs entirely in userspace, no TUN device required
RUN curl -fsSL https://pkgs.tailscale.com/stable/tailscale_1.76.6_amd64.tgz \
    | tar xzf - --strip-components=1 -C /usr/local/bin/ \
    tailscale_1.76.6_amd64/tailscaled \
    tailscale_1.76.6_amd64/tailscale

# ── Pre-download the decoy model at build time (faster cold start) ──
# This caches distilbert in the image so startup is instant
RUN python3 -c "from transformers import pipeline; pipeline('text-classification', model='distilbert-base-uncased-finetuned-sst-2-english')"

# ── Copy application files ──
COPY app.py .
COPY start.sh .
RUN chmod +x start.sh

# ── HF Spaces requires USER 1000 and port 7860 ──
RUN useradd -m -u 1000 appuser 2>/dev/null || true
# Tailscale state directory (writable by non-root)
RUN mkdir -p /tmp/tailscale-state && chown -R 1000:1000 /app /tmp/tailscale-state
USER 1000

# Only port 7860 — HF blocks everything else
EXPOSE 7860

ENTRYPOINT ["./start.sh"]