FROM python:3.12-slim-bookworm

RUN useradd --create-home --uid 1000 --shell /usr/sbin/nologin appuser \
    && mkdir -p /app /etc/cert-portal \
    && chown -R appuser:appuser /app /etc/cert-portal

WORKDIR /app

COPY pyproject.toml README.md /app/
COPY src /app/src
COPY docs /app/docs

RUN pip install --no-cache-dir --upgrade pip \
    && pip install --no-cache-dir /app \
    && chown -R appuser:appuser /app

USER appuser
EXPOSE 8000
ENV HOST=0.0.0.0 PORT=8000
CMD ["python", "-m", "cert_portal"]