Dockerfile

FROM python:3.12 AS base


FROM base AS python-deps

# Install pipenv and compilation dependencies
RUN pip install pipenv
RUN apt-get update && apt-get install -y --no-install-recommends gcc

# Install python dependencies in /.venv
COPY Pipfile .
COPY Pipfile.lock .
RUN PIPENV_VENV_IN_PROJECT=1 pipenv install --deploy


FROM base AS runtime

# Copy virtual env from python-deps stage
COPY --from=python-deps /.venv /.venv
ENV PATH="/.venv/bin:$PATH"

# Create and switch to a new user
RUN useradd --create-home appuser
WORKDIR /home/appuser/governance

# Precreate runtime-writable dirs (cache, optional logs) and set ownership
RUN mkdir -p /home/appuser/governance/cache /home/appuser/governance/app/cache \
 && chown -R appuser:appuser /home/appuser

USER appuser

# Copy code with correct ownership
COPY --chown=appuser:appuser ./app ./app
COPY --chown=appuser:appuser ./workers ./workers

ENV PYTHONPATH=/home/appuser/governance