FROM python:3.12-slim

ARG ACE_VERSION=1.5.0
LABEL org.opencontainers.image.title="ace-core" \
      org.opencontainers.image.version="${ACE_VERSION}" \
      org.opencontainers.image.source="https://github.com/augmented-cognition-engine/core"
ENV ACE_RELEASE_VERSION="${ACE_VERSION}" \
    PATH="/app/.venv/bin:${PATH}"

WORKDIR /app

RUN pip install --no-cache-dir uv

# Install the same complete source surface used to build the wheel. The old
# order installed an editable project before its packages existed and omitted
# the thin MCP client, README, and license metadata from the image entirely.
COPY pyproject.toml uv.lock build_backend.py README.md ROADMAP.md VISION.md MANIFESTO.md CONTRIBUTING.md SECURITY.md CHANGELOG.md LICENSE NOTICE ./
COPY core/ core/
COPY extensions/ extensions/
COPY ace/ ace/
COPY ace_mcp_client/ ace_mcp_client/
COPY scripts/ scripts/
COPY evaluations/ evaluations/
COPY docs/ docs/
# Create the venv with pip in it, then sync into it. Without the seed step uv
# builds /app/.venv with no pip, and since the venv is first on PATH `which pip`
# falls through to the system one, which installs into a site-packages the
# application interpreter never reads. An operator installing a domain pack saw
# "Successfully installed", saw `pip show` find it, and the appliance had
# nothing.
#
# The seed belongs on `uv venv`, not on `uv sync` -- `uv sync --seed` is not a
# flag and fails the build, and `UV_VENV_SEED=1 uv sync` is accepted and seeds
# nothing. Both were tried; only this order leaves pip in the venv.
RUN uv venv --seed
RUN uv sync --frozen --no-dev --no-editable --no-cache

# Run as non-root for security — prevents container escapes from writing host files
RUN adduser --disabled-password --gecos "" aceuser && chown -R aceuser /app
USER aceuser

EXPOSE 3000 37778

# Liveness probe: always 200 if the event loop is alive.
# Use /health/live (not /health/ready) so Docker doesn't restart healthy
# instances while the DB is temporarily unavailable at startup.
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:3000/health/live')" || exit 1

CMD ["uvicorn", "core.engine.api.main:app", "--host", "0.0.0.0", "--port", "3000"]
