FROM python:3.14-slim-bookworm@sha256:516b51cb9db2ef061e465c803e50f64361b82cefd91e525b889b967b83e83527

ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PYTHONUTF8=1 \
    PYTHONPATH=/srv/web2py:/opt/deployment \
    WEB2PY_ROOT=/srv/web2py

WORKDIR /srv/web2py
COPY requirements-production.txt /opt/deployment/requirements-production.txt
RUN pip install --no-cache-dir --only-binary=:all: \
        -r /opt/deployment/requirements-production.txt \
    && groupadd --gid 10001 onezoom \
    && useradd --uid 10001 --gid 10001 --no-create-home --shell /usr/sbin/nologin onezoom

# Extract the reviewed release archive into deployment/debian/release first.
# Live configurations, SQL dumps and deployment keys must never enter this directory.
COPY release/ /srv/web2py/
COPY public-overlay/ /srv/web2py/
COPY entrypoint.py yanhuashu_wsgi.py gunicorn.conf.py appconfig.ini.template /opt/deployment/
RUN test -f web2py.py \
    && test -f applications/OZtree/models/db.py \
    && test -f applications/OZtree/NOTICE.txt \
    && test ! -f applications/OZtree/private/appconfig.ini \
    && test ! -f applications/OZtree/private/my.cnf \
    && mkdir -p deposit logs site-packages applications/OZtree/cron \
        applications/OZtree/databases applications/OZtree/errors \
        applications/OZtree/sessions applications/OZtree/cache applications/OZtree/uploads \
    && chown 10001:10001 applications/OZtree/private \
        applications/OZtree/databases applications/OZtree/errors \
        applications/OZtree/sessions applications/OZtree/cache applications/OZtree/uploads \
    && chmod 700 applications/OZtree/private

# The short entrypoint reads root-owned Compose secrets, writes app-only configuration
# and drops to uid/gid 10001 before starting Gunicorn. Gunicorn never runs as root.
ENTRYPOINT ["python", "/opt/deployment/entrypoint.py"]
CMD ["gunicorn", "--config", "/opt/deployment/gunicorn.conf.py", "yanhuashu_wsgi:application"]
