# =============================================================================
# Stage 1: Builder
# =============================================================================
FROM python:3.12-slim AS builder

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1

RUN apt-get update && apt-get install -y \
    build-essential \
    curl \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

RUN pip install poetry==1.8.3

ENV POETRY_NO_INTERACTION=1 \
    POETRY_VIRTUALENVS_IN_PROJECT=1 \
    POETRY_CACHE_DIR=/tmp/poetry_cache

WORKDIR /app
COPY pyproject.toml README.md ./
RUN poetry install --only=main --no-root && rm -rf $POETRY_CACHE_DIR

# =============================================================================
# Stage 2: Runtime
# =============================================================================
FROM python:3.12-slim AS runtime

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PATH="/app/.venv/bin:$PATH" \
    HOME="/app" \
    XDG_CACHE_HOME="/app/.cache" \
    HF_HOME="/app/.cache/huggingface" \
    MODEL_CHECKPOINT_PATH="/app/models/production_model.pt"

RUN apt-get update && apt-get install -y \
    libgl1 \
    libglib2.0-0 \
    libgomp1 \
    curl \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app
RUN groupadd -g 1000 appgroup && useradd -u 1000 -g appgroup -m appuser

RUN mkdir -p /app/.cache/huggingface /app/models /app/logs && \
    chown -R appuser:appgroup /app/.cache /app/models /app/logs && \
    chmod -R 755 /app/.cache /app/models /app/logs

COPY --from=builder /app/.venv /app/.venv
COPY src/ /app/src/
COPY scripts/ /app/scripts/

RUN python -m compileall /app/src

RUN chown -R appuser:appgroup /app
USER appuser

EXPOSE 7860

HEALTHCHECK --interval=60s --timeout=10s --start-period=20s --retries=3 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:7860/healthz', timeout=5)"

CMD ["uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "7860", "--no-access-log"]