# syntax=docker/dockerfile:1
#
# Container image for the xmldiff web GUI.
#   docker build -t xmldiff-web:latest .
#
# The package is not installed, matching the layout used outside Docker: the code
# lives in src/xmldiff and PYTHONPATH points at src/. Only its dependencies come
# from pip.
FROM python:3.13-slim AS base

# lxml needs no compiler on wheels, but libxml2/libxslt keep the wheel honest for
# platforms where lxml has no prebuilt one.
ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PYTHONPATH=/app/src

RUN apt-get update \
 && apt-get install -y --no-install-recommends libxml2 libxslt1.1 \
 && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Requirements first, so the layer caches across source edits.
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

COPY src ./src

# Run unprivileged: the service needs no write access and no root.
RUN useradd --create-home --uid 10001 xmldiff \
 && chown -R xmldiff:xmldiff /app
USER xmldiff

EXPOSE 8200

# The bind address and port are fixed here; the TLS paths are not baked into the
# image, because they point at a host mount that only exists at run time.
# run_server_docker.sh passes XMLDIFF_TLS_CERT/KEY in and mounts ./certs read-only.
ENV XMLDIFF_HOST=0.0.0.0 \
    XMLDIFF_PORT=8200

# Tries HTTPS then plain HTTP, whichever the container ended up serving. Kept as
# a module rather than a `python -c` one-liner because the fallback needs a
# try/except and a break, which are unreadable when shell-quoted.
HEALTHCHECK --interval=15s --timeout=3s --start-period=5s --retries=3 \
  CMD ["python", "-m", "xmldiff.healthcheck"]

CMD ["python", "-m", "xmldiff", "serve"]