# ---- 构建阶段 ----
FROM python:3.12-slim AS builder

WORKDIR /app

# 系统依赖：python-magic、ClamAV 客户端、编译工具
RUN apt-get update && apt-get install -y --no-install-recommends \
    libmagic1 libmagic-dev \
    clamav clamav-daemon \
    && rm -rf /var/lib/apt/lists/*

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# ---- 运行阶段 ----
FROM python:3.12-slim

WORKDIR /app

# 系统运行时依赖
RUN apt-get update && apt-get install -y --no-install-recommends \
    libmagic1 clamav clamav-daemon ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd -r meshsafe && useradd -r -g meshsafe -d /app meshsafe

COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
COPY --from=builder /usr/local/bin /usr/local/bin

# 应用代码
COPY app/ ./app/
COPY config/policy.yaml ./config/policy.yaml
COPY config/diagnostics.yaml ./config/diagnostics.yaml
COPY scripts/ ./scripts/
COPY static/ ./static/
COPY tests/ ./tests/

# 日志目录、临时目录
RUN mkdir -p /var/log/meshsafe /tmp/meshsafe /app/rules \
    && chown -R meshsafe:meshsafe /app /var/log/meshsafe /tmp/meshsafe

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    MESHSAFE_LOG_DIR=/var/log/meshsafe \
    MESHSAFE_TEMP_ROOT=/tmp/meshsafe

USER meshsafe

EXPOSE 8443

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8443/api/v1/health', timeout=3).read()" || exit 1

CMD ["sh", "-c", "uvicorn app.main:app --host 0.0.0.0 --port 8443 --workers ${UVICORN_WORKERS:-1}"]