FROM python:3.12-slim-bookworm

ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1

WORKDIR /app

RUN groupadd --system gpsd && useradd --system --gid gpsd --home-dir /app gpsd

COPY pyproject.toml README.md ./
COPY src ./src

RUN python -m pip install --no-cache-dir --upgrade pip \
    && python -m pip install --no-cache-dir .

USER gpsd

CMD ["python", "-c", "import shared.contracts; print('gps-denied runtime scaffold ready')"]