FROM python:3.12-slim@sha256:5e2bdb1b0d542d5039cffb8181c65930093949194a65c365dfb1b0fe13a4fa5b

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

WORKDIR /app
COPY requirements.txt /app/requirements.txt
RUN pip install --no-cache-dir -r requirements.txt

COPY cove/ /app/cove/

RUN useradd --system --uid 10001 --home /app cove \
    && mkdir /data && chown cove /data

# Deliberately no bind-host override here: the image keeps the loopback default
# and stays unreachable until the operator sets it (docker-compose.yml does).
ENV COVE_DB_PATH=/data/cove.db
VOLUME /data
EXPOSE 8300
USER cove

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s \
  CMD python -c "import os,urllib.request;urllib.request.urlopen(f'http://127.0.0.1:{os.environ.get(\"COVE_BIND_PORT\",\"8300\")}/healthz',timeout=4)"

# Cove is single-process (workers=1); a second container on the same /data
# volume exits on the DB lock. `docker compose run --rm cove check|gen-key`.
ENTRYPOINT ["python", "-m", "cove"]
