# ---- Base Stage ----
FROM python:3.10 as base

# Create non-root user
RUN useradd -m -s /bin/bash appuser

# Set working directory
WORKDIR /app

# Set environment variables
ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PATH="/home/appuser/.local/bin:${PATH}" \
    DEBIAN_FRONTEND=noninteractive

# ---- Dependencies Stage ----
FROM base as dependencies

# Install only essential system dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Create directories and set permissions
RUN chown -R appuser:appuser /app

# ---- Builder Stage ----
FROM dependencies as builder

# Copy dependency files
COPY --chown=appuser:appuser requirements.txt ./

# Switch to non-root user
USER appuser

# Upgrade pip and install Python dependencies
RUN pip install --no-cache-dir --user --upgrade pip && \
    pip install --no-cache-dir --user -r requirements.txt

# ---- Final Stage ----
FROM dependencies as final

# Copy installed dependencies from builder
COPY --from=builder --chown=appuser:appuser /home/appuser/.local /home/appuser/.local

# Copy application code
COPY --chown=appuser:appuser . .

# Switch to non-root user
USER appuser

# Command to run the application
CMD ["sh", "-c", "alembic upgrade head && PYTHONPATH=/app/src exec gunicorn \
    -b ${UVICORN_HOST}:${UVICORN_PORT} \
    -w ${UVICORN_WORKERS} \
    --timeout 3600 \
    --enable-stdio-inheritance \
    -k uvicorn.workers.UvicornWorker \
    api:app"]