FROM python:3.12-slim AS builder
# Build-time deps for compiling Python packages (WeasyPrint, pycryptodome, etc.)
RUN apt-get update && apt-get install -y --no-install-recommends \
build-essential \
libpango-1.0-0 libpangocairo-1.0-0 libgdk-pixbuf-2.0-0 \
libcairo2 libglib2.0-0 libfribidi0 libltdl7 libthai0 libpangoft2-1.0-0 \
libfontconfig1 libfreetype6 fontconfig pkg-config \
python3-dev libffi-dev libssl-dev && \
rm -rf /var/lib/apt/lists/*
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt
# --- Final stage ---
FROM python:3.12-slim
# Runtime-only system deps (no compilers)
RUN apt-get update && apt-get install -y --no-install-recommends \
libpango-1.0-0 libpangocairo-1.0-0 libgdk-pixbuf-2.0-0 \
libcairo2 libglib2.0-0 libfribidi0 libltdl7 libthai0 libpangoft2-1.0-0 \
libfontconfig1 libfreetype6 fontconfig \
fonts-dejavu-core fonts-liberation fonts-inter fonts-jetbrains-mono \
ca-certificates && \
rm -rf /var/lib/apt/lists/*
# Copy installed Python packages from builder
COPY --from=builder /install /usr/local
WORKDIR /app
COPY app/ app/
COPY tests/ tests/
COPY sdk/ sdk/
COPY alembic.ini alembic/ /app/
RUN mkdir -p /app/data/documents && \
mkdir -p /var/cache/fontconfig && \
useradd -m -r -s /bin/false appuser && \
chown -R appuser:appuser /app /var/cache/fontconfig
USER appuser
CMD ["gunicorn", "--bind", "0.0.0.0:5060", "--workers", "2", "--timeout", "300", "app.app:create_app()"]