Dockerfile

# Build Stage
FROM python:3.11-slim as builder

WORKDIR /app

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

COPY requirements.txt .
RUN pip wheel --no-cache-dir --no-deps --wheel-dir /app/wheels -r requirements.txt

# Runtime Stage
FROM python:3.11-slim

WORKDIR /app

# Create non-root user
RUN addgroup --system sentinal && adduser --system --group sentinal

# Copy wheels and install
COPY --from=builder /app/wheels /wheels
RUN pip install --no-cache /wheels/*

# Copy application code
COPY . .

# Ownership
RUN chown -R sentinal:sentinal /app

# Copy scripts and make executable
COPY scripts/ /app/scripts/
RUN chmod +x /app/scripts/*.sh

USER sentinal

# Expose API port
EXPOSE 8000

ENTRYPOINT ["/app/scripts/entrypoint.sh"]
CMD ["python", "main.py"]