# ==============================================================================
# CropAI Cloud Run Production Container
# Multi-stage, non-root security, Gunicorn + Uvicorn Workers
# ==============================================================================

# Stage 1: Build Dependencies
FROM python:3.11-slim as builder

WORKDIR /install

RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    libjpeg-dev \
    zlib1g-dev \
    && rm -rf /var/lib/apt/lists/*

COPY requirements.txt .
RUN pip install --prefix=/install --no-cache-dir -r requirements.txt

# Stage 2: Final Production Runtime
FROM python:3.11-slim

# Security & Performance Environment Variables
ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PORT=8080 \
    HOST=0.0.0.0 \
    APP_ENV=production \
    WORKERS=2 \
    THREADS=4 \
    TIMEOUT=120

WORKDIR /app

# Install runtime dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    libjpeg62-turbo \
    zlib1g \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Copy installed python packages from builder
COPY --from=builder /install /usr/local

# Copy application source code
COPY . /app/backend

# Create non-root system user for security
RUN groupadd -r appgroup && useradd -r -g appgroup -d /app -s /sbin/nologin appuser \
    && chown -R appuser:appgroup /app

USER appuser

EXPOSE 8080

# Cloud Run Container Health Check
HEALTHCHECK --interval=30s --timeout=10s --start-period=20s --retries=3 \
  CMD curl -f http://localhost:${PORT}/health || exit 1

# Start Production Server with Gunicorn + Uvicorn workers
CMD exec gunicorn backend.main:app \
    --workers ${WORKERS} \
    --threads ${THREADS} \
    --worker-class uvicorn.workers.UvicornWorker \
    --bind 0.0.0.0:${PORT} \
    --timeout ${TIMEOUT} \
    --keep-alive 5 \
    --access-logfile - \
    --error-logfile -