Dockerfile.distroless

# syntax=docker/dockerfile:1.7
FROM oven/bun:1.3.7-alpine AS frontend-build

WORKDIR /app/frontend

COPY frontend/package.json frontend/bun.lock ./
RUN --mount=type=cache,target=/root/.bun/install/cache \
    bun install --frozen-lockfile

COPY frontend ./
RUN bun run build

FROM python:3.13-slim-bookworm AS python-build

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    UV_PROJECT_ENVIRONMENT=/opt/venv \
    UV_LINK_MODE=copy

WORKDIR /app

RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

RUN pip install --no-cache-dir uv

COPY pyproject.toml uv.lock ./
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --no-dev --no-install-project

RUN mkdir -p /var/lib/codex-lb

# Stage arch-specific shared libraries for distroless copy
RUN ARCH="$(uname -m)" && \
    mkdir -p /staged-libs/lib /staged-libs/usr/lib && \
    cp -a "/lib/${ARCH}-linux-gnu" "/staged-libs/lib/${ARCH}-linux-gnu" && \
    cp -a "/usr/lib/${ARCH}-linux-gnu" "/staged-libs/usr/lib/${ARCH}-linux-gnu"

FROM gcr.io/distroless/base-debian12:nonroot AS runtime

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PATH="/opt/venv/bin:/usr/local/bin:$PATH"

WORKDIR /app

COPY --from=python-build /staged-libs/lib/ /lib/
COPY --from=python-build /staged-libs/usr/lib/ /usr/lib/
COPY --from=python-build /usr/local /usr/local
COPY --from=python-build /opt/venv /opt/venv
COPY --from=python-build --chown=nonroot:nonroot /var/lib/codex-lb /var/lib/codex-lb
COPY --chown=nonroot:nonroot app app
COPY --chown=nonroot:nonroot config config
COPY --chown=nonroot:nonroot scripts scripts
COPY --from=frontend-build --chown=nonroot:nonroot /app/app/static app/static

EXPOSE 2455 1455

USER nonroot:nonroot
CMD ["python", "/app/scripts/distroless-entrypoint.py"]