links/Dockerfile

FROM ghcr.io/astral-sh/uv:bookworm-slim AS uv

# Build stage
FROM python:3.12-slim AS builder

# Set environment variables
ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1
ENV PYTHONPATH=/app
ENV UV_CACHE_DIR=/tmp/.cache/uv
ENV UV_VENV_DIRECTORY=/app/.venv
ENV DEBIAN_FRONTEND=noninteractive

# Set work directory
WORKDIR /app

# Install build dependencies in one layer (minimal set)
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    gcc \
    nodejs \
    npm \
    gettext \
    && rm -rf /var/lib/apt/lists/* \
    && apt-get clean \
    && npm cache clean --force

# Copy uv binary
COPY --from=uv /usr/local/bin/uv /usr/local/bin/uv

# Copy dependency files first for better caching
COPY pyproject.toml uv.lock ./

# Install Python dependencies
RUN uv sync --no-dev --frozen --no-install-project

# Copy only necessary project files
COPY manage.py ./
COPY core/ ./core/
COPY links/ ./links/
COPY invest/ ./invest/
COPY netscan/ ./netscan/
COPY nginxmon/ ./nginxmon/
COPY routermon/ ./routermon/
COPY pricemon/ ./pricemon/
COPY jbot/ ./jbot/
COPY new_theme/ ./new_theme/
COPY templates/ ./templates/
COPY locale/ ./locale/
COPY tailwind.config.js ./
COPY static/ ./static/

# Build static assets and translations
RUN uv run manage.py tailwind install \
    && uv run manage.py tailwind build \
    && uv run manage.py collectstatic --noinput \
    && uv run manage.py compilemessages --locale=zh_Hans \
    && rm -rf /app/new_theme/static_src/node_modules

# Install Playwright and browsers (chromium-headless-shell only, no full chromium)
ENV PLAYWRIGHT_BROWSERS_PATH=/app/.playwright
RUN uv run playwright install chromium --with-deps

# Clean up build artifacts aggressively
RUN rm -rf /tmp/.cache/uv ~/.npm ~/.cache \
    && find /app -name "*.pyc" -delete \
    && find /app -name "__pycache__" -type d -exec rm -rf {} + || true \
    && find /app -type f -name "*.md" -delete \
    && find /app -type f -name "*.txt" ! -name "requirements.txt" -delete \
    && rm -rf /app/.venv/lib/python3.12/site-packages/pip \
    && rm -rf /app/.venv/lib/python3.12/site-packages/setuptools \
    && rm -rf /app/.playwright/chromium-* \
    && rm -rf /app/.playwright/ffmpeg-* \
    && find /app/.venv -name "*.so" -exec strip {} + 2>/dev/null || true \
    && find /app/.venv -type d -name "test*" -exec rm -rf {} + 2>/dev/null || true \
    && find /app/.venv -type d -name "*test" -exec rm -rf {} + 2>/dev/null || true

# Production stage - use Python 3.12 slim
FROM python:3.12-slim AS production

# Build-time metadata
ARG BUILD_TIME=""
ARG BUILD_VERSION=""

# Set environment variables
ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1
ENV PYTHONPATH=/app
ENV VIRTUAL_ENV=/app/.venv
ENV PATH="/app/.venv/bin:$PATH"
ENV DEBIAN_FRONTEND=noninteractive
ENV PLAYWRIGHT_BROWSERS_PATH=/app/.playwright
ENV BUILD_TIME=${BUILD_TIME}
ENV BUILD_VERSION=${BUILD_VERSION}

# Set work directory
WORKDIR /app

# Install only runtime dependencies in one layer
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl \
    ca-certificates \
    fonts-noto-cjk \
    libglib2.0-0 \
    libnss3 \
    libnspr4 \
    libatk1.0-0 \
    libatk-bridge2.0-0 \
    libcups2 \
    libdrm2 \
    libdbus-1-3 \
    libxcb1 \
    libxkbcommon0 \
    libx11-6 \
    libxcomposite1 \
    libxdamage1 \
    libxext6 \
    libxfixes3 \
    libxrandr2 \
    libgbm1 \
    libpango-1.0-0 \
    libcairo2 \
    libasound2 \
    ffmpeg \
    && rm -rf /var/lib/apt/lists/* \
    && apt-get clean \
    && rm -rf /tmp/* /var/tmp/* \
    && rm -rf /usr/share/doc/* \
    && rm -rf /usr/share/man/*

# Create non-root user and directories
RUN useradd -m -u 1000 appuser \
    && mkdir -p /app/data/media/screenshots \
    && mkdir -p /app/.playwright \
    && chown -R appuser:appuser /app

# Copy only the virtual environment and built assets from builder
COPY --from=builder /usr/local/bin/uv /usr/local/bin/uv
COPY --from=builder --chown=appuser:appuser /app/.venv /app/.venv
COPY --from=builder --chown=appuser:appuser /app/.playwright /app/.playwright
COPY --from=builder --chown=appuser:appuser /app/staticfiles /app/staticfiles
COPY --from=builder --chown=appuser:appuser /app/locale /app/locale

# Copy application code (minimal)
COPY --chown=appuser:appuser manage.py ./
COPY --chown=appuser:appuser core/ ./core/
COPY --chown=appuser:appuser links/ ./links/
COPY --chown=appuser:appuser invest/ ./invest/
COPY --chown=appuser:appuser netscan/ ./netscan/
COPY --chown=appuser:appuser nginxmon/ ./nginxmon/
COPY --chown=appuser:appuser routermon/ ./routermon/
COPY --chown=appuser:appuser pricemon/ ./pricemon/
COPY --chown=appuser:appuser jbot/ ./jbot/
COPY --chown=appuser:appuser new_theme/ ./new_theme/
COPY --chown=appuser:appuser templates/ ./templates/
COPY --chown=appuser:appuser static/ ./static/
COPY --chown=appuser:appuser qdrant_sync.py ./
COPY --chown=appuser:appuser entrypoint.sh ./

# Final cleanup
RUN find /app -name "*.pyc" -delete \
    && find /app -name "__pycache__" -type d -exec rm -rf {} + || true

# Switch to non-root user
USER appuser

# Expose port 8000
EXPOSE 8000

# Health check
HEALTHCHECK --interval=30s --timeout=30s --start-period=5s --retries=3 \
    CMD curl -f http://localhost:8000/ || exit 1

# Run migrations then start gunicorn
CMD ["/bin/sh", "/app/entrypoint.sh"]