# syntax=docker/dockerfile:1
# Pinned by manifest digest; update tag and digest together.
FROM python:3.12.11-slim-bookworm@sha256:519591d6871b7bc437060736b9f7456b8731f1499a57e22e6c285135ae657bf7 AS builder

ENV PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIP_NO_CACHE_DIR=1

WORKDIR /build
COPY backend/pyproject.toml ./pyproject.toml
COPY backend/src ./src
RUN python -m pip install --upgrade pip==25.3 && \
    python -m pip wheel --wheel-dir /wheels .

FROM python:3.12.11-slim-bookworm@sha256:519591d6871b7bc437060736b9f7456b8731f1499a57e22e6c285135ae657bf7 AS runtime

ENV PATH="/opt/venv/bin:${PATH}" \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    BACKUP_TOOL_ALEMBIC_ROOT=/app

RUN groupadd --gid 10001 backup-tool && \
    useradd --uid 10001 --gid backup-tool --create-home --home-dir /home/backup-tool \
        --shell /usr/sbin/nologin backup-tool && \
    python -m venv /opt/venv && \
    install --directory --owner=backup-tool --group=backup-tool --mode=0750 \
        /var/lib/backup-tool \
        /var/lib/backup-tool/repositories \
        /var/lib/backup-tool/restores \
        /run/backup-tool

COPY --from=builder /wheels /wheels
RUN python -m pip install --no-index --find-links=/wheels backup-tool==2.0.0.dev0 && \
    rm -rf /wheels
COPY --chown=backup-tool:backup-tool backend/alembic.ini /app/alembic.ini
COPY --chown=backup-tool:backup-tool backend/alembic /app/alembic

WORKDIR /app
USER backup-tool:backup-tool

ENTRYPOINT ["backup-tool"]
CMD ["web"]