FROM python:3.12-slim AS builder

# Prevent .pyc files and enable unbuffered stdout/stderr
ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

WORKDIR /app

# Install build tools in builder stage only
RUN apt-get update && \
    apt-get install -y --no-install-recommends gcc libc6-dev && \
    rm -rf /var/lib/apt/lists/*

# Install deps first — layer cache reuse on code-only changes
COPY requirements.txt .
RUN --mount=type=cache,target=/root/.cache/pip \
    pip install --no-cache-dir -r requirements.txt

# Runtime stage - clean slate
FROM python:3.12-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

WORKDIR /app

# Copy only installed packages from builder
COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
COPY --from=builder /usr/local/bin /usr/local/bin

# Copy source
COPY main.py config.py ./
COPY modules/ modules/

# Run as non-root
RUN adduser --disabled-password --gecos "" botuser && \
    mkdir -p /app/storage /app/logs && \
    chown -R botuser:botuser /app

USER botuser

# Persistent volume for Pyrogram session and logs
VOLUME ["/app/storage", "/app/logs"]

CMD ["python", "main.py"]