Dockerfile.contacts

# SkyLink Contacts Service - Secure Dockerfile
# Multi-stage build for minimal image size and security

# Stage 1: Build
FROM python:3.12-slim AS builder

# Install poetry
RUN pip install --no-cache-dir poetry==1.7.1

# Set working directory
WORKDIR /build

# Copy dependency files
COPY pyproject.toml poetry.lock* ./

# Install dependencies (without dev dependencies)
RUN poetry config virtualenvs.in-project true && \
    poetry install --no-interaction --no-ansi --only main --no-root

# Copy application code
COPY contacts/ ./contacts/

# Install the project
RUN poetry install --no-interaction --no-ansi --only main

# Stage 2: Runtime
FROM python:3.12-slim

# Security: Create non-root user
RUN groupadd -r skylink && \
    useradd -r -g skylink -u 1000 -m -s /sbin/nologin skylink

# Set working directory
WORKDIR /app

# Copy virtual environment from builder
COPY --from=builder /build/.venv /app/.venv

# Copy application code
COPY --from=builder /build/contacts /app/contacts

# Security: Set proper ownership
RUN chown -R skylink:skylink /app

# Switch to non-root user
USER skylink

# Environment variables
ENV PATH="/app/.venv/bin:$PATH" \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8003/health')"]

# Expose port
EXPOSE 8003

# Run application
CMD ["python", "-m", "uvicorn", "contacts.main:app", "--host", "0.0.0.0", "--port", "8003"]