# Gehaertete Ausfuehrungsumgebung: ohne root, ohne Shell-Aufrufe (Anhang O/secgate).
FROM python:3.12-slim AS base

ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
RUN useradd --create-home --uid 10001 secgate
WORKDIR /app

COPY pyproject.toml README.md ./
COPY src ./src
COPY policies ./policies
RUN pip install --no-cache-dir ".[dev]"

USER secgate
ENTRYPOINT ["secgate"]
