FROM python:3.12.11-slim

# ---------- System packages ----------
RUN apt-get update && apt-get install -y --no-install-recommends \
        build-essential curl git chromium chromium-driver fonts-liberation libgbm1 \
    && rm -rf /var/lib/apt/lists/*

# ---------- Non-root user ----------
RUN useradd -m -u 1000 appuser
USER appuser

# ---------- Workdir ----------
WORKDIR /app

# ---------- Environment ----------
ENV HOME=/app \
    STREAMLIT_CONFIG_DIR=/app/.streamlit \
    XDG_CACHE_HOME=/app/.cache \
    HF_HOME=/app/.cache/huggingface \
    STREAMLIT_BROWSER_GATHERUSAGESTATS=false \
    STREAMLIT_CLI_DISABLE_USAGE_STATS=true \
    PATH="/app/.local/bin:$PATH" \
    CHROME_BIN=/usr/bin/chromium \
    CHROMEDRIVER_PATH=/usr/bin/chromedriver

RUN mkdir -p /app/.streamlit /app/.cache/huggingface/hub

# ---------- Python deps ----------
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# ---------- App code ----------
COPY streamlit_app.py ./streamlit_app.py

# ---------- Health & expose ----------
EXPOSE 8501
HEALTHCHECK CMD curl --fail http://localhost:8501/_stcore/health || exit 1

# ---------- Start ----------
ENTRYPOINT ["streamlit", "run", "streamlit_app.py", "--server.port=8501", "--server.address=0.0.0.0", "--server.enableXsrfProtection=false"]