Dockerfile

# -- Builder stage
# Installs build-time dependencies and Python packages.
FROM python:3.13.6-alpine3.22 AS builder

# build-base is needed to compile C/C++ extensions for the materialyoucolor package.
# git is needed for the git+https dependency in requirements.txt.
RUN apk add --no-cache build-base~=0.5 git~=2.49

WORKDIR /vixipy

# Copy requirements.txt by itself to cache it as a separate, early layer.
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# -- Final stage
# Creates a lean production image.
FROM python:3.13.6-alpine3.22

# Add runtime dependency for C++ extensions compiled in the builder stage
# and create a dedicated, non-root user and group for the application.
RUN apk add --no-cache libstdc++~=14.2 && \
    addgroup -S vixipy && \
    adduser -S -D -h /vixipy vixipy vixipy

WORKDIR /vixipy

# Copy installed Python packages and their binaries from the builder stage.
COPY --from=builder /usr/local/lib/python3.13/site-packages /usr/local/lib/python3.13/site-packages
COPY --from=builder /usr/local/bin /usr/local/bin

# Copy the application source code into the final image.
# NOTE: The 'instance' directory for configuration (e.g., config.py, custom themes)
# should be mounted as a volume by the user at runtime.
COPY --chown=vixipy:vixipy vixipy/ ./vixipy/

USER vixipy

# Set environment variables for runtime configuration.
ENV VIXIPY_PORT=8000
# VIXIPY_SECRET_KEY is left unset by default so it gets generated by the CMD.

EXPOSE 8000

# NOTE: `exec` is used for proper signal handling (e.g., SIGTERM from `docker stop`).
CMD ["sh", "-c", "export VIXIPY_SECRET_KEY=${VIXIPY_SECRET_KEY:-$(head -c 50 /dev/urandom | base64)} && exec python -m vixipy --bind \":${VIXIPY_PORT}\""]