Dockerfile

# syntax=docker/dockerfile:1
#
# Multi-stage build. One image serves BOTH the FastAPI backend and the
# Streamlit dashboard — the compose file picks the entrypoint per service
# (api → uvicorn, dashboard → streamlit). Build once, run twice.

# ----------------------------------------------------------------- builder
FROM python:3.12-slim AS builder

# uv for fast, reproducible installs straight from the committed lockfile.
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv

ENV UV_COMPILE_BYTECODE=1 \
    UV_LINK_MODE=copy \
    UV_PYTHON_DOWNLOADS=never

WORKDIR /app

# Install third-party deps first so this layer caches unless the lockfile
# changes. --no-dev keeps pytest/ruff/mypy out of the runtime image.
COPY pyproject.toml uv.lock ./
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --no-install-project --no-dev

# Now install the project itself (needs the source tree present).
COPY src ./src
COPY alembic ./alembic
COPY alembic.ini ./
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --no-dev

# ----------------------------------------------------------------- runtime
FROM python:3.12-slim AS runtime

# Non-root runtime user.
RUN useradd --create-home --uid 10001 appuser

WORKDIR /app

COPY --from=builder /app/.venv /app/.venv
COPY --from=builder /app/src ./src
COPY --from=builder /app/alembic ./alembic
COPY --from=builder /app/alembic.ini ./
COPY scripts ./scripts

ENV PATH="/app/.venv/bin:$PATH" \
    PYTHONUNBUFFERED=1 \
    PYTHONPATH=/app/src

USER appuser

# 8000 = FastAPI, 8501 = Streamlit. compose maps only what each service needs.
EXPOSE 8000 8501

# Default entrypoint is the API. The dashboard service overrides `command`.
CMD ["uvicorn", "linkedin_agent.api.main:app", "--host", "0.0.0.0", "--port", "8000"]