FROM python:3.12-slim
LABEL org.opencontainers.image.source="https://github.com/batrapulkit/squidbrake" \
      org.opencontainers.image.description="Squidbrake: brakes for your AI agents" \
      org.opencontainers.image.licenses="Apache-2.0"

ENV PYTHONUNBUFFERED=1 PIP_NO_CACHE_DIR=1 \
    IN_DOCKER=1 HOST=0.0.0.0 PORT=8080 WORKERS=1 FORWARDED_ALLOW_IPS=*
WORKDIR /app

COPY requirements.txt .
# psycopg: the image runs on Postgres too (DATABASE_URL=postgresql://..., docs/postgres-supabase.md)
RUN pip install -r requirements.txt "psycopg[binary]>=3.1"

# Every module server.py imports (tests/test_packaging.py checks this list), plus the shipped-rules fingerprints
COPY server.py service.py onboard.py shell_guard.py runs.py selfguard.py weekly.py integrity.py connect.py flow.py hooklog.py commands.py risk.py taint.py verify.py signing.py offline.py proof.py brief.py passkeys.py sso.py pilot.py telemetry.py evidence.py lockdown.py license.py mcp_catalog.py mcp_hub.py mcp_oauth.py outbound.py policy_edit.py siem.py gateway_proxy.py gw_async.py rules.yaml rules.shipped dashboard.html approve.html ./
COPY squidbrake/__init__.py squidbrake/__init__.py
RUN useradd -r -u 10001 gateway && mkdir -p /app/data && chown -R gateway /app/data
USER gateway

EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
  CMD python -c "import urllib.request,os; urllib.request.urlopen(f'http://127.0.0.1:{os.environ[\"PORT\"]}/health', timeout=4)"

# Keys and the database live in /app/data; the first start creates the keys and prints them once.
CMD ["python", "server.py", "run"]