# Lab 05 — production-shaped container image (Knowledge Module 07 §4).
# Multi-stage, slim base, NON-ROOT, no secrets baked in, healthcheck.
# Build:  docker build -t bank-assistant:dev .
# Run:    docker run -p 8000:8000 bank-assistant:dev
# Push:   docker tag ... <acr>.azurecr.io/bank-assistant:1.0 && docker push ...

FROM python:3.12-slim AS builder
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt

FROM python:3.12-slim
# Non-root user: containers must not run as root in a bank.
RUN useradd -m appuser
COPY --from=builder /install /usr/local
COPY . /app
WORKDIR /app
USER appuser
EXPOSE 8000
# Orchestrator (Container Apps/AKS) probes /health; readiness checks deps via /ready.
HEALTHCHECK --interval=30s --timeout=3s CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"
# Secrets are injected at runtime via Managed Identity / Key Vault — NEVER in the image.
CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "8000"]