FROM python:3.12-slim

WORKDIR /app

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY . .

RUN mkdir -p /app/uploads /app/store && \
    adduser --disabled-password --no-create-home appuser && \
    chown -R appuser:appuser /app

USER appuser

EXPOSE 8080

ENV PORT=8080

CMD gunicorn --bind 0.0.0.0:${PORT} --workers 4 --timeout 120 app:app