# 使用Python 3.11 slim基镜像；包含FFmpeg后的实际镜像体积需测量
FROM python:3.11-slim

# 设置工作目录
WORKDIR /code

# 安装系统依赖 (psycopg2 需要；ffmpeg 用于音频上传重编码净化)
RUN apt-get update && apt-get install -y --no-install-recommends \
    libpq-dev \
    ca-certificates \
    libssl-dev \
    ffmpeg \
    && rm -rf /var/lib/apt/lists/*

# 先复制依赖文件，利用 Docker 缓存层
COPY ./requirements.txt ./requirements.lock ./requirements-build.lock /code/
RUN python -m pip install --no-cache-dir --require-hashes --only-binary=:all: -r /code/requirements-build.lock \
    && python -m pip install --no-cache-dir --require-hashes --no-build-isolation -r /code/requirements.lock \
    && python -m pip check

# 复制应用代码
COPY . .

# 安全加固：以非root用户运行
RUN useradd -m -s /bin/bash appuser && chown -R appuser:appuser /code
USER appuser

# 健康检查
HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:7860/health')" || exit 1

# force rebuild: 2026-08-16

# 启动命令
CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860"]