# ── 构建阶段 ──
FROM python:3.11-slim AS builder

WORKDIR /build
RUN apt-get update -qq && apt-get install -y -qq --no-install-recommends gcc g++ python3-dev && rm -rf /var/lib/apt/lists/*

COPY pyproject.toml .
RUN pip install --no-cache-dir -i https://pypi.tuna.tsinghua.edu.cn/simple --upgrade pip && \
    pip download --no-cache-dir -i https://pypi.tuna.tsinghua.edu.cn/simple -d /wheels -e . && \
    pip download --no-cache-dir -i https://pypi.tuna.tsinghua.edu.cn/simple -d /wheels gunicorn

# ── 运行阶段 ──
FROM python:3.11-slim

ENV TZ=Asia/Shanghai
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone

WORKDIR /app

COPY --from=builder /wheels /wheels
RUN pip install --no-cache-dir --find-links /wheels cfc-langgraph gunicorn && rm -rf /wheels

COPY app/ app/
COPY data/ data/

RUN useradd -m -u 1000 appuser && chown -R appuser:appuser /app
USER appuser

EXPOSE 9000

CMD ["gunicorn", "app.main:app", \
     "--worker-class", "uvicorn.workers.UvicornWorker", \
     "--bind", "0.0.0.0:9000", \
     "--workers", "2", \
     "--timeout", "60", \
     "--keep-alive", "10", \
     "--access-logfile", "-", \
     "--error-logfile", "-"]