FROM python:3.12-slim

# Create non-root user with UID 1000 matching Kubernetes pod securityContext
RUN groupadd -g 1000 appuser && useradd -u 1000 -g appuser -m -d /app appuser

WORKDIR /app

ENV HOME=/app
ENV NEEDLE_PORT=5005
ENV NEEDLE_HOST=0.0.0.0
ENV NEEDLE_TELEMETRY=0

# Install dependencies
RUN pip install --no-cache-dir cactus-needle

# Pre-cache model and shared library into /app/.cache as user 1000
RUN python -c "import needle; needle.Needle()"

COPY server.py /app/server.py

# Ensure UID 1000 owns /app and all caches
RUN chown -R appuser:appuser /app

USER appuser

EXPOSE 5005

CMD ["python", "/app/server.py"]
