# albok-service — the FastAPI process that owns the buildings-and-wings store (unit 2).
# Built from the repository root:  docker build -f packages/albok-service/Dockerfile -t pfi/albok-service .
# The whole packages/ tree is copied because uv resolves the workspace (every member's pyproject) before
# installing just --package albok-service; albok-client and albok-nemi are not installed in the image.
# Runs as the dedicated `albok` user (rev 3 §3.1): the store root and private volume are bind-mounted
# and must be owned by that uid on the host; viewers mount the store root :ro with group_add by gid.
FROM python:3.11-slim-bookworm

RUN apt-get update -qq && apt-get install -y --no-install-recommends git ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && groupadd --gid 1500 albok && useradd --uid 1500 --gid albok --create-home --shell /usr/sbin/nologin albok

RUN pip install -q --no-cache-dir uv

WORKDIR /app
COPY pyproject.toml uv.lock README.md ./
COPY src ./src
COPY packages ./packages
RUN uv sync --frozen --no-dev --package albok-service

ENV PATH="/app/.venv/bin:$PATH" \
    ALBOK_CONFIG=/etc/albok/albok.yaml \
    GIT_OPTIONAL_LOCKS=0

USER albok
EXPOSE 8390
# the config names store_root and private_root; both are bind mounts owned by albok
ENTRYPOINT ["python", "-m", "albok_service"]
