# Use an official Python runtime as a parent image
FROM python:3.9-slim-bookworm

# --- Basic runtime hygiene ---
ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

# Workdir
WORKDIR /usr/src/app

# Copy only requirements first to leverage Docker layer cache
COPY requirements.txt .

# Install Python deps
RUN pip install --no-cache-dir -r requirements.txt

# Copy the rest of your app
COPY . .

# Create a non-root user and give ownership
RUN adduser --disabled-password --gecos "" appuser \
  && chown -R appuser:appuser /usr/src/app

USER appuser

# Expose the service port
EXPOSE 5000

CMD ["python", "-u", "db.py"]