# probes daemon image — synthetic infra canary.
#
# Build context is THIS directory's parent (infra/probes/):
#   docker build -f deploy/Dockerfile -t probes:dev infra/probes
#
# marin-iris, marin-finelog, marin-rigging are installed from PyPI per the
# lockfile (their nightly dev wheels). No marin source is required in the
# build context.

FROM python:3.12-slim AS base

LABEL org.opencontainers.image.source="https://github.com/marin-community/marin"
LABEL org.opencontainers.image.description="probes daemon image"

RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/*

COPY --from=ghcr.io/astral-sh/uv:0.10.3 /uv /uvx /bin/


# ── deps stage ───────────────────────────────────────────────────────
# Install dependencies first so source edits don't bust the dep cache.
FROM base AS deps

WORKDIR /app
ENV PATH="/app/.venv/bin:$PATH"
ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1

COPY pyproject.toml uv.lock ./
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --no-install-project --no-dev

# Project source, then install the project itself.
COPY src/ ./src/
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --no-dev


# ── runtime stage ────────────────────────────────────────────────────
FROM deps AS runtime

# /var/lib/probes holds the JSONL result sink. In the COS deployment it is a
# host-path bind mount (see README) so it survives container restarts; an
# anonymous VOLUME would be orphaned on every konlet recreate. The in-image
# mkdir/chown is only the fallback for a plain `docker run` with no mount.
RUN groupadd --system --gid 1000 infra-probes \
    && useradd --system --uid 1000 --gid infra-probes --home-dir /app --no-create-home infra-probes \
    && mkdir -p /var/lib/probes \
    && chown infra-probes:infra-probes /var/lib/probes

USER infra-probes

# ENTRYPOINT (not CMD) so COS --container-arg values append as arguments
# instead of replacing the command — otherwise the first arg is exec'd as the
# binary.
ENTRYPOINT ["python", "-m", "infra_probes"]
