FROM python:3.12-slim AS base

WORKDIR /app

# Install only server dependencies
COPY pyproject.toml README.md ./
COPY policyshield/ policyshield/
RUN pip install --no-cache-dir ".[server]"

# Default rules directory (can be overridden by volume mount)
RUN mkdir -p /app/rules
COPY examples/fastapi_agent/policies/rules.yaml /app/rules/rules.yaml

# Create non-root user for security
RUN groupadd -r pshield && useradd -r -g pshield -d /app pshield \
    && chown -R pshield:pshield /app
USER pshield

EXPOSE 8100

HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8100/api/v1/health')"

ENTRYPOINT ["policyshield", "server"]
CMD ["--rules", "/app/rules/rules.yaml", "--port", "8100", "--host", "0.0.0.0"]
