FROM python:3.12-slim-bookworm

COPY --from=ghcr.io/astral-sh/uv:0.10.8 /uv /uvx /bin/

RUN python -m pip install --no-cache-dir --upgrade "pip==26.1.2"

WORKDIR /app

# Explicit UID 1000 matches the runtime UID expected by the Dagster chart
RUN addgroup --gid 1000 appgroup && \
    adduser --uid 1000 --gid 1000 --disabled-password --gecos "" appuser

RUN apt-get update && apt-get upgrade -y \
    && apt-get install -y --no-install-recommends \
    git=1:2.39.5-0+deb12u3 \
    curl=7.88.1-10+deb12u15 \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

RUN chown -R appuser:appgroup /app /opt

COPY pyproject.toml .
COPY uv.lock .
COPY src/ ./src/
COPY payload/ ./payload/
COPY workspace.yaml .

ENV UV_COMPILE_BYTECODE=1
ENV UV_LINK_MODE=copy

RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --locked --no-dev

ENV PATH="/app/.venv/bin:${PATH}"
ENV PYTHONPATH="/app/src"

USER appuser

RUN dagster --version

EXPOSE 4000

CMD ["dagster", "code-server", "start", "-h", "0.0.0.0", "-p", "4000", "-f", "src/distributed_execution/repository.py"]