# mdmem — build: podman build -t harbor.cloud.traunseenet.com/library/mdmem:0.1.0 -f Containerfile .
FROM docker.io/library/python:3.12-slim-bookworm AS build

COPY --from=ghcr.io/astral-sh/uv:0.5.18 /uv /usr/local/bin/uv
ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_PYTHON_DOWNLOADS=never
WORKDIR /app

# Dependencies first, so a source-only change does not re-resolve the world.
COPY pyproject.toml uv.lock README.md ./
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --no-install-project --no-dev

COPY src ./src
RUN --mount=type=cache,target=/root/.cache/uv uv sync --frozen --no-dev

# ---------------------------------------------------------------------------
FROM docker.io/library/python:3.12-slim-bookworm

# readOnlyRootFilesystem: true (§13a.3) — nothing may write outside /data and /tmp.
ENV HOME=/tmp \
    XDG_CACHE_HOME=/tmp \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PATH="/app/.venv/bin:$PATH"

WORKDIR /app
COPY --from=build /app/.venv /app/.venv
COPY --from=build /app/src /app/src

# The sqlite-vec shared object ships inside the image and is loaded read-only (§14.16).
RUN /app/.venv/bin/python -c "import sqlite_vec, os; p = sqlite_vec.loadable_path(); \
    assert os.path.exists(p + '.so') or os.path.exists(p), p; print('sqlite-vec at', p)"

USER 1000:1000
EXPOSE 8080 8081
VOLUME ["/data"]
ENTRYPOINT ["/app/.venv/bin/mdmem"]
CMD ["serve"]
