FROM python:3.13-slim

WORKDIR /app

# Install system dependencies and security updates
RUN apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends \
    curl \
    && rm -rf /var/lib/apt/lists/*

# Upgrade pip, setuptools, and wheel to latest (security fix)
RUN pip install --no-cache-dir --upgrade pip setuptools wheel

# Install CPU-only PyTorch first (saves ~6GB vs GPU version)
RUN pip install --no-cache-dir torch --index-url https://download.pytorch.org/whl/cpu

# Install Python dependencies
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Pre-download the model during build (avoids first-request delay)
RUN python -c "from sentence_transformers import SentenceTransformer; SentenceTransformer('all-MiniLM-L6-v2')"

# Copy application
COPY main.py .

# Create non-root user
RUN useradd -m -u 1000 mira && chown -R mira:mira /app
USER mira

EXPOSE 8200

CMD ["python", "-m", "uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8200"]
