FROM ghcr.io/astral-sh/uv:python3.12-bookworm-slim

WORKDIR /app

# workspace root + both members so the frozen lockfile resolves; the build
# context is the repo root (see docker-compose.yml)
COPY pyproject.toml uv.lock ./
COPY server/pyproject.toml ./server/
COPY server/src ./server/src
COPY server/migrations ./server/migrations
COPY client/pyproject.toml ./client/
COPY client/src ./client/src

# sentence-transformers (real embedder) is a default dependency: the image
# carries torch by design
RUN uv sync --frozen --no-dev --package lloom-server

RUN useradd --system --create-home lloom && chown -R lloom:lloom /app
USER lloom

ENV PATH="/app/.venv/bin:$PATH"

EXPOSE 8000

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=5 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/v1/health/live', timeout=3)"

CMD ["lloom-server", "serve"]
