# ai-api — FastAPI. Built on the host from ~/ai/api.
FROM python:3.12-slim

# Non-root. The container has no reason to be root and one good reason not to
# be: it shares a host with live control.
RUN useradd --create-home --uid 10001 appuser

WORKDIR /app

# Requirements first so a code change does not re-resolve the dependency tree.
COPY requirements.txt .
RUN pip install --no-cache-dir --requirement requirements.txt

# The document-upload dependencies go in a SECOND layer, so changing them does
# not invalidate the one above. Four pure-Python wheels, a few megabytes, no
# compiler. See requirements-docs.txt for what belongs here and what does not.
COPY requirements-docs.txt .
RUN pip install --no-cache-dir --requirement requirements-docs.txt

COPY . .

USER appuser
EXPOSE 8000

# No published port in ai-compose.yml - Caddy reaches this on the proxy network.
# Single worker: the PoC is one operator at a time, and a second worker doubles
# the connection count against imh for no benefit.
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "1"]