FROM python:3.12.13-slim-bookworm@sha256:d50fb7611f86d04a3b0471b46d7557818d88983fc3136726336b2a4c657aa30b

ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1
ENV PIP_DISABLE_PIP_VERSION_CHECK=1
ENV PIP_NO_CACHE_DIR=1
ENV PIP_ROOT_USER_ACTION=ignore

RUN groupadd --gid 10001 dzentra \
    && useradd --uid 10001 \
        --gid dzentra \
        --no-create-home \
        --home-dir /nonexistent \
        --shell /usr/sbin/nologin \
        dzentra \
    && install -d \
        -m 0700 \
        -o dzentra \
        -g dzentra \
        /var/lib/dzentra \
    && install \
        -m 0600 \
        -o dzentra \
        -g dzentra \
        /dev/null \
        /var/lib/dzentra/runtime.env

WORKDIR /project/app

COPY app/requirements.lock ./requirements.lock
RUN python -m pip install \
    --require-hashes \
    --requirement requirements.lock

COPY --chown=10001:10001 app/src ./src

USER 10001:10001

STOPSIGNAL SIGINT

CMD ["python", "-m", "src.main"]