FROM python:3.12-slim

# Prevent .pyc files and enable unbuffered stdout/stderr
ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

WORKDIR /app

# Install deps first — layer cache reuse on code-only changes
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Copy source
COPY main.py config.py ./
COPY modules/ modules/

# Run as non-root
RUN adduser --disabled-password --gecos "" botuser && \
    mkdir -p /app/storage /app/logs && \
    chown -R botuser:botuser /app

USER botuser

# Persistent volume for Pyrogram session and logs
VOLUME ["/app/storage", "/app/logs"]

CMD ["python", "main.py"]