FROM python:3.12-slim

WORKDIR /app

# Build context is the repo root (see docker-compose.yml) so shared/ is
# copyable; shared/ holds the access-control model used by api + webui.
COPY webui/requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY shared /app/shared
COPY webui /app/webui

WORKDIR /app/webui

# shared/ is installed at /app/shared; make it importable from /app/webui.
ENV PYTHONPATH=/app

RUN useradd --system --no-create-home webui
USER webui

CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8080"]