# modwall-bridge dla Chevereto — lekki sidecar (czysty Python, bez kompilacji).
FROM python:3.12-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

WORKDIR /app

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY bridge.py .

# Nie-root + własny katalog stanu (wolumen /data).
RUN useradd -r -u 10001 bridge && mkdir -p /data && chown bridge:bridge /data
USER bridge
VOLUME /data

CMD ["python", "bridge.py"]
