# Multi-Stage Production Dockerfile for CFI Fraud Detection Platform

# ── Stage 1: Build Dependencies ──────────────────────
FROM python:3.12-slim-bookworm AS builder

WORKDIR /build

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_NO_CACHE_DIR=1

RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    curl \
    git \
    && rm -rf /var/lib/apt/lists/*

RUN pip install --no-cache-dir uv

COPY backend/requirements.txt ./
RUN uv venv /opt/venv && \
    . /opt/venv/bin/activate && \
    uv pip install -r requirements.txt

# ── Stage 2: Production Runtime ──────────────────────
FROM python:3.12-slim-bookworm AS runtime

WORKDIR /app

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PATH="/opt/venv/bin:$PATH" \
    PYTHONPATH="/app/backend" \
    APP_ENV="development" \
    APP_DEBUG="false" \
    HOME="/home/user" \
    CFI_STORAGE_DIR="/app/storage"

RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd -g 1000 user \
    && useradd -u 1000 -g user -m -d /home/user -s /bin/sh user \
    && mkdir -p /home/user /app/storage /app/logs /tmp/cfi_storage \
    && chmod -R 777 /home/user /app /tmp/cfi_storage \
    && chown -R user:user /home/user /app /tmp/cfi_storage

COPY --from=builder /opt/venv /opt/venv
COPY --chown=user:user backend /app/backend

RUN chmod -R 777 /home/user /app/storage /app/logs /tmp/cfi_storage

USER user

EXPOSE 7860

HEALTHCHECK --interval=10s --timeout=3s --start-period=30s --retries=5 \
    CMD curl -f http://localhost:7860/health || exit 1

CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "7860"]