FROM python:3.12-slim
RUN pip install --no-cache-dir fastapi "uvicorn[standard]" python-multipart gspread
WORKDIR /app
COPY . /app
RUN mkdir -p /app/static/img && useradd -r -u 10001 app
# Unprivileged: nothing here needs root, and the process is the one thing on
# this box that takes unauthenticated input from the internet.
USER 10001
CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "8000"]