Dockerfile

# Build the CLI into a small runtime image.
#
# Stage 1 resolves the locked dependency set with uv; stage 2 keeps only the
# resulting virtualenv, so neither uv nor the build context ship in the final
# image.

FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim AS builder

# hatch-vcs reads the version from Git, and .git is deliberately absent from
# the build context. The version is injected instead: the CI passes the tag,
# and a local `docker build` falls back to the placeholder below.
# hatch-vcs delegates to setuptools-scm, which reads its own variable, so both
# are set from the same argument.
ARG HATCH_VCS_PRETEND_VERSION=0.0.0.dev0
ENV HATCH_VCS_PRETEND_VERSION=${HATCH_VCS_PRETEND_VERSION} \
    SETUPTOOLS_SCM_PRETEND_VERSION=${HATCH_VCS_PRETEND_VERSION} \
    SETUPTOOLS_SCM_PRETEND_VERSION_FOR_PYONYPHE=${HATCH_VCS_PRETEND_VERSION}

ENV UV_COMPILE_BYTECODE=1 \
    UV_LINK_MODE=copy \
    UV_PYTHON_DOWNLOADS=never

WORKDIR /app

# Dependencies first: this layer is cached until pyproject.toml or uv.lock move.
# --extra cli is required since 3.1.0: typer and rich moved out of the runtime
# dependencies, and the image exists to ship the CLI.
COPY pyproject.toml uv.lock ./
RUN uv sync --frozen --no-dev --no-install-project --extra cli

COPY README.md LICENSE ./
COPY src ./src
RUN uv sync --frozen --no-dev --no-editable --extra cli


FROM python:3.13-slim-bookworm

LABEL org.opencontainers.image.source="https://github.com/onyphe/pyonyphe" \
      org.opencontainers.image.description="CLI for the ONYPHE Cyber Defense Search Engine" \
      org.opencontainers.image.licenses="MIT"

RUN useradd --create-home --uid 1000 onyphe

COPY --from=builder --chown=onyphe:onyphe /app/.venv /app/.venv
ENV PATH="/app/.venv/bin:${PATH}"

USER onyphe
WORKDIR /work

ENTRYPOINT ["pyonyphe"]
CMD ["--help"]