# The base by tag and digest (Redmine #5029): every build of one commit, staging's and production's,
# runs on the same OS layers. Dependabot's docker updater moves the digest in an ordinary pull
# request; .github/scripts/security_baseline.py fails a FROM without one.
FROM python:3.12-slim-bookworm@sha256:935c3c5b12357a7e10caa9c1e6ca5692344d97cf229832ef584be2cec9fc03df AS dependencies

WORKDIR /build
COPY requirements-bootstrap.txt .
RUN python -m pip install --no-cache-dir -r requirements-bootstrap.txt
# The hash-pinned lock made from requirements.txt (Redmine #4988): every build of one commit, in CI
# or on a host, installs the same set, and pip refuses a file whose SHA-256 the lock does not list.
COPY requirements.lock.txt .
# Only application distributions and their console scripts cross the stage boundary.
RUN python -m pip install --no-cache-dir --require-hashes --ignore-installed --prefix=/runtime \
        -r requirements.lock.txt

FROM python:3.12-slim-bookworm@sha256:935c3c5b12357a7e10caa9c1e6ca5692344d97cf229832ef584be2cec9fc03df

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

WORKDIR /app

# Debian's security fixes reach the official Python image some days after they reach Debian. Until the
# base carries libssl3 and openssl 3.0.22-1~deb12u2 (CVE-2026-84782, Redmine #4917) and apt and
# libapt-pkg6.0 2.6.2 (CVE-2026-109518, Redmine #5026), all HIGH findings of the image scan, the image
# takes them from Debian itself. Once the base has them this changes nothing, and the step can be deleted.
RUN apt-get update \
    && apt-get install -y --no-install-recommends --only-upgrade libssl3 openssl apt libapt-pkg6.0 \
    && rm -rf /var/lib/apt/lists/*

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        libpq5 \
        libpango-1.0-0 \
        libpangocairo-1.0-0 \
        libpangoft2-1.0-0 \
        libharfbuzz0b \
        libgdk-pixbuf-2.0-0 \
        libffi8 \
        shared-mime-info \
        fonts-liberation \
    && rm -rf /var/lib/apt/lists/*

# The base image also supplies pip and an ensurepip wheel; neither is a runtime input.
RUN rm -rf /usr/local/lib/python3.12/site-packages/pip \
        /usr/local/lib/python3.12/site-packages/pip-*.dist-info \
        /usr/local/lib/python3.12/ensurepip \
        /usr/local/bin/pip /usr/local/bin/pip3 /usr/local/bin/pip3.12
COPY --from=dependencies /runtime /usr/local

COPY . .
COPY legal /usr/share/licenses/openatos
RUN python -m licensing.runtime
RUN python -m licensing.inventory --requirements requirements.txt --build-requirements requirements-bootstrap.txt --scope runtime --output /usr/share/licenses/openatos/python-runtime.json
RUN chmod +x entrypoint.sh

ARG OPENATOS_BUILD_REVISION=""
LABEL org.opencontainers.image.revision=$OPENATOS_BUILD_REVISION
RUN python -c 'import os,re,pathlib; value=os.environ.get("OPENATOS_BUILD_REVISION", ""); assert not value or re.fullmatch("[a-f0-9]{40}", value); p=pathlib.Path("/usr/share/openatos"); p.mkdir(); (p/"build-revision").write_text(value+"\n")'

EXPOSE 8000
ENTRYPOINT ["./entrypoint.sh"]
CMD ["daphne", "-b", "0.0.0.0", "-p", "8000", "openatos.asgi:application"]
