# kos-backup — cloud-agnostic service image (runs on any K8s / any cloud).
# Multi-arch friendly: python:slim works on amd64 and arm64 alike.
FROM python:3.12-slim

# Non-root by default (K8s securityContext also enforces it).
RUN useradd -u 10001 -m svc
WORKDIR /app

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY kos_backup_service/ ./kos_backup_service/

USER 10001
EXPOSE 8900
ENV KOS_BACKUP_HOST=0.0.0.0 \
    KOS_BACKUP_PORT=8900 \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

# Uvicorn via the module entrypoint (reads KOS_BACKUP_* + auth/store env).
CMD ["python", "-m", "kos_backup_service.app"]
