FROM python:3.12-slim

# Base image hafton purana ho sakta hai. Security updates yahin laga do,
# warna pipeline ka Trivy gate HIGH/CRITICAL par build rok dega.
RUN apt-get update \
 && apt-get upgrade -y \
 && apt-get autoremove -y --purge \
 && rm -rf /var/lib/apt/lists/*

WORKDIR /srv
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY app/ ./app/

ARG APP_VERSION=dev
ENV APP_VERSION=${APP_VERSION}

RUN useradd -r -u 1001 appuser
USER appuser

EXPOSE 8000
HEALTHCHECK --interval=30s --timeout=3s CMD python -c "import urllib.request;urllib.request.urlopen('http://127.0.0.1:8000/health')"

# Tracing default OFF. k8s manifest me OTEL_SDK_DISABLED=false karke on hota hai,
# taaki build/smoke test ke waqt export ki koshish na ho.
ENV OTEL_SDK_DISABLED=true \
    OTEL_TRACES_EXPORTER=otlp \
    OTEL_METRICS_EXPORTER=none \
    OTEL_LOGS_EXPORTER=none \
    OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf

CMD ["opentelemetry-instrument", "gunicorn", "--bind", "0.0.0.0:8000", "--workers", "2", "app.main:app"]