FROM python:3.13-slim

WORKDIR /app

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt gunicorn

COPY . .

RUN addgroup --system --gid 1000 app && adduser --system --uid 1000 --ingroup app --home /home/app app && \
    mkdir -p /home/app && chown app:app /home/app && \
    chown -R app:app /app && chmod -R u+w /app
USER app

EXPOSE 5005

CMD ["gunicorn", "-b", "0.0.0.0:5005", "-w", "4", "app:app"]