FROM python:3.12-slim-bookworm AS dependencies

WORKDIR /build
COPY requirements-bootstrap.txt .
RUN python -m pip install --no-cache-dir -r requirements-bootstrap.txt
COPY requirements.txt .
# Only application distributions and their console scripts cross the stage boundary.
RUN python -m pip install --no-cache-dir --ignore-installed --prefix=/runtime -r requirements.txt

FROM python:3.12-slim-bookworm

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

WORKDIR /app

# Debian's security fixes reach the official Python image some days after they reach Debian. Until the
# base carries libssl3 and openssl 3.0.22-1~deb12u2 (CVE-2026-84782, a HIGH finding of the image scan,
# Redmine #4917) the image takes them from Debian itself. Once the base has them this changes nothing,
# and the step can be deleted.
RUN apt-get update \
    && apt-get install -y --no-install-recommends --only-upgrade libssl3 openssl \
    && rm -rf /var/lib/apt/lists/*

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        libpq5 \
        libpango-1.0-0 \
        libpangocairo-1.0-0 \
        libpangoft2-1.0-0 \
        libharfbuzz0b \
        libgdk-pixbuf-2.0-0 \
        libffi8 \
        shared-mime-info \
        fonts-liberation \
    && rm -rf /var/lib/apt/lists/*

# The base image also supplies pip and an ensurepip wheel; neither is a runtime input.
RUN rm -rf /usr/local/lib/python3.12/site-packages/pip \
        /usr/local/lib/python3.12/site-packages/pip-*.dist-info \
        /usr/local/lib/python3.12/ensurepip \
        /usr/local/bin/pip /usr/local/bin/pip3 /usr/local/bin/pip3.12
COPY --from=dependencies /runtime /usr/local

COPY . .
COPY legal /usr/share/licenses/openatos
RUN python -m licensing.runtime
RUN python -m licensing.inventory --requirements requirements.txt --build-requirements requirements-bootstrap.txt --scope runtime --output /usr/share/licenses/openatos/python-runtime.json
RUN chmod +x entrypoint.sh

ARG OPENATOS_BUILD_REVISION=""
LABEL org.opencontainers.image.revision=$OPENATOS_BUILD_REVISION
RUN python -c 'import os,re,pathlib; value=os.environ.get("OPENATOS_BUILD_REVISION", ""); assert not value or re.fullmatch("[a-f0-9]{40}", value); p=pathlib.Path("/usr/share/openatos"); p.mkdir(); (p/"build-revision").write_text(value+"\n")'

EXPOSE 8000
ENTRYPOINT ["./entrypoint.sh"]
CMD ["daphne", "-b", "0.0.0.0", "-p", "8000", "openatos.asgi:application"]
