Dockerfile

# Base image pinned by digest (3.12-slim as of 2026-07-01); bump deliberately, not implicitly.
FROM python:3.12-slim@sha256:423ed6ab25b1921a477529254bfeeabf5855151dc2c3141699a1bfc852199fbf

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1

WORKDIR /app

RUN apt-get update \
    && apt-get install -y --no-install-recommends postgresql-client tini gosu \
    && rm -rf /var/lib/apt/lists/*

COPY requirements.lock .
RUN pip install --no-cache-dir --require-hashes -r requirements.lock

COPY . .
# Run as an unprivileged user. The entrypoint starts as root only to chown the
# bind-mounted volumes, then drops to this user via gosu.
RUN chmod +x /app/docker-entrypoint.sh \
    && useradd --create-home --uid 10001 appuser \
    && mkdir -p /app/logs /app/backups \
    && chown -R appuser:appuser /app

# Healthcheck verifies that the python process tree is alive AND the DB is reachable.
HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
    CMD pg_isready -h "${POSTGRES_HOST:-postgres}" -p "${POSTGRES_PORT:-5432}" \
        -U "${POSTGRES_USER}" -d "${POSTGRES_DB}" >/dev/null 2>&1 || exit 1

ENTRYPOINT ["/usr/bin/tini", "--", "/app/docker-entrypoint.sh"]
# Migrations live in the bot's command (not the entrypoint) so taskiq and one-shot
# `compose run` commands don't trigger them.
CMD ["sh", "-c", "alembic upgrade head && exec python main.py"]