# Stage 1: Build
FROM cgr.dev/chainguard/python:latest-dev AS builder

# Set build directory
WORKDIR /app

# Copy project files and ensure they are owned by the nonroot user (65532)
COPY --chown=65532:65532 . .

# Create a virtual environment and install dependencies
# We use a relative path 'venv' to stay within the writable /app directory.
RUN python -m venv venv
ENV PATH="/app/venv/bin:$PATH"
RUN pip install --no-cache-dir -r requirements.txt

# Stage 2: Runtime
FROM cgr.dev/chainguard/python:latest

# Set environment variables
ENV PATH="/app/venv/bin:$PATH"
# In distroless-style images, we don't have a shell, so we must be explicit.
ENV PYTHONUNBUFFERED=1

# Work in the standard /app directory
WORKDIR /app

# Copy virtual environment and application files from builder
# We use --chown to ensure the runtime user (nonroot/65532) can access the files.
COPY --from=builder --chown=65532:65532 /app /app

# Expose port
EXPOSE 5000

# Run gunicorn using the virtual environment's python directly or gunicorn binary.
ENTRYPOINT ["/app/venv/bin/gunicorn", "--bind", "0.0.0.0:5000", "app:app"]

#harbor.freshbrewed.science/library/k8s-pulse