Dockerfile

# syntax=docker/dockerfile:1

# -----------------------------------------------------------------------------
# Builder stage
# -----------------------------------------------------------------------------
# Build all Python dependencies as wheels in a throwaway image. This keeps the
# final runtime image smaller and avoids leaving compilers/build headers behind.
FROM python:3.12-slim AS builder

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1

WORKDIR /build

# gcc/python headers/libpq-dev are needed by native dependencies such as
# asyncpg/psycopg2 when a prebuilt wheel is unavailable for the target platform.
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        build-essential \
        gcc \
        libpq-dev \
        python3-dev \
    && rm -rf /var/lib/apt/lists/*

COPY requirements.txt .

# Pre-build dependency wheels into /wheels. The runner stage installs only from
# this directory, which avoids contacting PyPI during the final image assembly.
RUN python -m pip install --upgrade pip wheel \
    && python -m pip wheel --wheel-dir /wheels -r requirements.txt


# -----------------------------------------------------------------------------
# Runner stage
# -----------------------------------------------------------------------------
# Same Python base as the builder for ABI compatibility with compiled wheels.
FROM python:3.12-slim AS runner

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PATH="/home/appuser/.local/bin:${PATH}"

WORKDIR /srv/liberostack

# libpq5 is the small runtime library used by PostgreSQL drivers. No compilers
# are installed here, reducing both image size and attack surface.
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        ca-certificates \
        libpq5 \
    && rm -rf /var/lib/apt/lists/* \
    && addgroup --system appuser \
    && adduser --system --ingroup appuser --home /home/appuser appuser

COPY --from=builder /wheels /wheels
COPY requirements.txt .

# Install dependencies from local wheels only. /wheels is removed afterward so
# the shipped image contains just the installed packages and application code.
RUN python -m pip install --upgrade pip \
    && python -m pip install --no-index --find-links=/wheels -r requirements.txt \
    && rm -rf /wheels

# Copy only runtime application files. Secrets such as .env are intentionally
# not copied into the image; docker-compose injects them at container runtime.
COPY app ./app
COPY migrations ./migrations
COPY alembic.ini ./alembic.ini

USER appuser

EXPOSE 8000

# Production command: no reload, no debug server. Uvicorn binds to all container
# interfaces so Caddy can reverse proxy to the service over Docker networking.
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]