Dockerfile.brain

FROM python:3.12-slim AS builder

COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/

WORKDIR /app

ENV UV_COMPILE_BYTECODE=1 \
    UV_LINK_MODE=copy \
    UV_PYTHON_DOWNLOADS=never

RUN --mount=type=cache,target=/root/.cache/uv \
    --mount=type=bind,source=uv.lock,target=uv.lock \
    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
    uv sync --locked --no-dev --no-install-project

COPY src/ ./src/
RUN --mount=type=cache,target=/root/.cache/uv \
    --mount=type=bind,source=uv.lock,target=uv.lock \
    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
    uv sync --locked --no-dev


FROM python:3.12-slim AS runtime

RUN groupadd -g 1001 appgroup && \
    useradd -u 1001 -g appgroup -m -d /app -s /bin/false appuser

WORKDIR /app

COPY --from=builder --chown=appuser:appgroup /app /app

# Pre-create the storage directory owned by appuser.
# Docker initialises a named volume from the image on first mount, so this
# ensures the volume is writable by the non-root user right away.
RUN mkdir -p /data && chown appuser:appgroup /data

# Put the venv on PATH so a2c-brain resolves directly.
ENV PATH="/app/.venv/bin:$PATH"

EXPOSE 50051
EXPOSE 50052

USER appuser

CMD ["a2c-brain"]