Dockerfile.server

# python:3.12-slim, digest resolved 2026-09-19. Multi-stage for the same
# reason as Dockerfile.bot: an isolated virtualenv build layer, since none of
# the pinned dependencies need a compiler.
FROM python:3.12-slim@sha256:f77ac9e44ae96ef2c90b8053ea08c31f8be030f824196b0ae4db6d462c84e51f AS builder

WORKDIR /app

RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

# requirements.lock is the hash-pinned, fully resolved closure generated from
# requirements.txt (see CONTRIBUTING.md); --require-hashes makes pip refuse
# to install anything whose hash does not match, so a compromised package
# index or a tampered wheel fails the build instead of shipping.
COPY requirements.lock ./
# pip uninstalls itself as the last step so the venv copied into the runtime
# layer below holds only the installed dependencies, not the installer, its
# metadata or setuptools/wheel (present only on interpreters where ensurepip
# still bundles them); pip removing its own files works because the running
# process has already read what it needs to finish the command.
RUN pip install --no-cache-dir --upgrade pip==26.2.1 \
    && pip install --no-cache-dir --require-hashes -r requirements.lock \
    && pip uninstall -y pip setuptools wheel

FROM python:3.12-slim@sha256:f77ac9e44ae96ef2c90b8053ea08c31f8be030f824196b0ae4db6d462c84e51f

LABEL org.opencontainers.image.source="https://github.com/fuegovic/Starguard" \
      org.opencontainers.image.description="Starguard OAuth callback server: handles the GitHub side of /verify." \
      org.opencontainers.image.licenses="MIT"

WORKDIR /app

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PATH="/opt/venv/bin:$PATH"

COPY --from=builder /opt/venv /opt/venv
COPY common/ ./common/
COPY server/ ./server/

# The pinned base lags Debian's security fixes by however long the image
# took to be rebuilt, and Trivy fails the build on any fixable HIGH it
# still carries (libssl3t64 3.5.7-1~deb13u2 was the first). Upgrading here
# takes the fixes Debian has already shipped, whatever they turn out to be,
# where pinning each package would need a commit per advisory.
RUN apt-get update \
    && apt-get upgrade -y \
    && rm -rf /var/lib/apt/lists/*

RUN useradd --create-home --uid 10001 starguard
USER starguard

EXPOSE 5000

CMD ["python", "-m", "server.server"]