Dockerfile

# ── Stage 1: builder ─────────────────────────────────────────────────────────
# Installs dependencies in an isolated layer.
# Rebuilds only when pyproject.toml or uv.lock changes.
FROM python:3.13-slim AS builder

WORKDIR /app

# Install uv
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv

# Install dependencies first (layer cache)
COPY pyproject.toml uv.lock ./
RUN uv sync --frozen --no-dev --no-install-project

# Install the project itself
COPY src/ ./src/
RUN uv sync --frozen --no-dev

# ── Stage 2: runtime ──────────────────────────────────────────────────────────
# Minimal image — no build tools, no uv, no source cache.
FROM python:3.13-slim AS runtime

WORKDIR /app

# Non-root user — never run as root in production
RUN addgroup --system app && adduser --system --ingroup app app

# Copy only the installed virtualenv from the builder
COPY --from=builder --chown=app:app /app/.venv /app/.venv
COPY --from=builder --chown=app:app /app/src /app/src

USER app

ENV PATH="/app/.venv/bin:$PATH" \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    ENV=production

EXPOSE 8000

# Replace with the actual entry point for your project:
#   uvicorn my_project.interfaces.api:app --host 0.0.0.0 --port 8000
CMD ["python", "-m", "my_project.main"]