# External payload image for the loosely coupled execution target.
#
# Built and versioned independently of the code location image. It contains no
# workflow code and no `dagster` package - only the pipes protocol client.
#
#   docker build -f payload/Dockerfile -t distributed-execution-payload:0.1.0 payload/

FROM python:3.12-slim-bookworm

RUN python -m pip install --no-cache-dir --upgrade "pip==26.1.2"

WORKDIR /app

RUN addgroup --gid 1000 appgroup && \
    adduser --uid 1000 --gid 1000 --disabled-password --gecos "" appuser

RUN apt-get update && apt-get upgrade -y \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY work.py .

RUN chown -R appuser:appgroup /app

USER appuser

CMD ["python", "/app/work.py"]