ARG PYTHON_BASE=python:3.14.5-slim-bookworm@sha256:ec58d916f9e24a6035cab2bdf07f6206c4cc092a16613c60597534711332d9d6
FROM ${PYTHON_BASE}
ARG BUILD_COMMIT=development
ARG BUILD_TIME=unknown
ARG DEBIAN_MIRROR=deb.debian.org
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 TZ=Asia/Shanghai \
    DATA_DIR=/data CONFIG_DIR=/config BUILD_COMMIT=$BUILD_COMMIT BUILD_TIME=$BUILD_TIME
WORKDIR /app
# CJK fonts intentionally retained for readable Chinese rendering.
RUN --mount=type=bind,source=build-cache/debs,target=/build-debs,readonly sed -i "s|http://deb.debian.org|https://${DEBIAN_MIRROR}|g" /etc/apt/sources.list.d/debian.sources \
    && apt-get update \
    && if [ -f /build-debs/fonts-noto-cjk.deb ]; then \
         font_version=$(apt-cache policy fonts-noto-cjk | awk '$1=="Candidate:" {print $2}'); \
         font_sha=$(apt-cache show "fonts-noto-cjk=$font_version" | awk '$1=="SHA256:" {print $2;exit}'); \
         test -n "$font_sha"; \
         echo "$font_sha  /build-debs/fonts-noto-cjk.deb" | sha256sum -c -; \
         cp /build-debs/fonts-noto-cjk.deb "/var/cache/apt/archives/fonts-noto-cjk_${font_version#*:}_all.deb"; \
       fi \
    && apt-get install -y --no-install-recommends fonts-noto-cjk tzdata \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd --gid 10333 frameflow && useradd --uid 10333 --gid 10333 --no-create-home frameflow \
    && mkdir -p /data/images /data/generated /data/cache /config \
    && chown -R 10333:10333 /data /config
COPY requirements.lock ./
RUN pip install --no-cache-dir -r requirements.lock
COPY pigway_frame_flow ./pigway_frame_flow
COPY vendor ./vendor
USER 10333:10333
EXPOSE 18787
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:18787/health',timeout=3)"
CMD ["python", "-m", "uvicorn", "pigway_frame_flow.main:app", "--host", "0.0.0.0", "--port", "18787", "--workers", "1", "--no-access-log"]
