FROM python:3.12-slim-bookworm

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PORT=7860 \
    UPSTAGE_CACHE_DIR=/home/user/.cache/upstage

RUN useradd --create-home --uid 1000 --shell /bin/bash user
WORKDIR /home/user/app

COPY --chown=user:user requirements.txt ./requirements.txt
RUN python -m pip install --upgrade pip && \
    python -m pip install --no-cache-dir -r requirements.txt

COPY --chown=user:user app.py tool_protocol.py upstage_provider.py upstage_interactive.py ./
RUN mkdir -p /home/user/.cache/upstage && chown -R user:user /home/user

USER user
EXPOSE 7860

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:7860/healthz', timeout=3)" || exit 1

CMD ["sh", "-c", "exec uvicorn app:app --host 0.0.0.0 --port ${PORT:-7860} --workers 1 --proxy-headers --forwarded-allow-ips='*'"]