FROM python:3.13-slim-bookworm
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PIP_DISABLE_PIP_VERSION_CHECK=1
WORKDIR /app
RUN apt-get update && apt-get install -y --no-install-recommends ffmpeg ca-certificates && rm -rf /var/lib/apt/lists/* && groupadd -g 10001 poetvoice && useradd -u 10001 -g 10001 -M -s /usr/sbin/nologin poetvoice
COPY requirements.lock ./
RUN pip install --no-cache-dir --require-hashes -r requirements.lock
COPY manage.py login.html client-security.js ./
COPY poetvoice ./poetvoice
COPY core ./core
COPY admin-dist ./admin-dist
USER 10001:10001
EXPOSE 8080
CMD ["gunicorn", "poetvoice.wsgi:application", "--bind", "0.0.0.0:8080", "--workers", "2", "--threads", "4", "--timeout", "120", "--max-requests", "2000", "--max-requests-jitter", "200", "--worker-tmp-dir", "/tmp", "--no-control-socket"]
