Dockerfile

FROM python:3.13-slim AS builder

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1

# Install build dependencies in a single layer and clean up immediately
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    && pip install --no-cache-dir uv \
    && apt-get purge -y build-essential \
    && apt-get autoremove -y \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

WORKDIR /app

# Copy dependency files and install
COPY pyproject.toml uv.lock ./
RUN uv sync --frozen

# Runtime stage - minimal base image
FROM python:3.13-slim AS runtime

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PYTHONPATH=/app \
    PATH="/app/.venv/bin:$PATH"

# Install system dependencies for mime type detection and document conversion
RUN apt-get update && apt-get install -y --no-install-recommends \
    libmagic1 \
    libreoffice-writer-nogui \
    libreoffice-java-common \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

# Install uv in runtime stage
RUN pip install --no-cache-dir uv

WORKDIR /app

# Create user first so we can use --chown in COPY commands
RUN useradd --create-home --shell /bin/bash --no-log-init app

# Copy only the virtual environment from builder with proper ownership
COPY --from=builder --chown=app:app /app/.venv /app/.venv

# Copy application code with proper ownership
COPY --chown=app:app . .

# Create uploads directory with proper ownership
RUN mkdir -p /app/uploads && chown app:app /app/uploads

USER app

# Every platform starts this image through `uv run` (scripts/start_api.sh, Railway's
# preDeployCommand, the Kubernetes migrate init container). By default `uv run` first syncs
# the venv, which rebuilds the project and downloads its build backend from PyPI in each new
# container: a start then fails without network access. The venv is complete, so skip it.
ENV UV_NO_SYNC=1

EXPOSE 8000

HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/api/health')" || exit 1

# Seeds the annotation sets, then serves on $PORT (Railway) or 8000; see the script.
CMD ["sh", "scripts/start_api.sh"]