FROM python:3.11.16-slim-bookworm@sha256:2e32f7d302adc1c37428355c1e646897c0c53f4fd60b6a551245fb90ee129f91

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PYTHONPATH=/opt/witness/source

RUN groupadd --gid 65532 witness \
    && useradd --uid 65532 --gid 65532 --home-dir /nonexistent --no-create-home witness \
    && mkdir /data \
    && chown 65532:65532 /data

COPY requirements.lock /opt/witness/requirements.lock
RUN python -m pip install --no-cache-dir --require-hashes -r /opt/witness/requirements.lock

COPY operator.py candidate.py source-closure.json /opt/witness/
COPY source /opt/witness/source
COPY cargo /opt/witness/cargo
COPY templates /opt/witness/templates

USER 65532:65532
WORKDIR /opt/witness
ENTRYPOINT ["python", "/opt/witness/operator.py"]
CMD ["serve", "--data", "/data", "--host", "0.0.0.0", "--port", "8080"]
