Dockerfile

# ============================================================
# WildGuard AI — Dockerfile
# Multi-stage build: builder (deps) → runtime (slim)
# Python 3.11-slim for minimal image size
# ============================================================

# -- Stage 1: Builder --
FROM python:3.11-slim AS builder

WORKDIR /build

# Install build deps for native extensions (mysql, pillow, etc.)
RUN apt-get update && apt-get install -y --no-install-recommends \
    gcc \
    libssl-dev \
    libffi-dev \
    default-libmysqlclient-dev \
    pkg-config \
    && rm -rf /var/lib/apt/lists/*

COPY requirements.txt .
RUN pip install --upgrade pip && \
    pip install --no-cache-dir --prefix=/install -r requirements.txt


# -- Stage 2: Runtime --
FROM python:3.11-slim AS runtime

LABEL maintainer="WildGuard AI <ops@wildguard.ai>"
LABEL version="1.0.0"

WORKDIR /app

# Runtime system deps only
RUN apt-get update && apt-get install -y --no-install-recommends \
    libgomp1 \
    && rm -rf /var/lib/apt/lists/*

# Copy installed packages from builder
COPY --from=builder /install /usr/local

# Copy application code
COPY . .

# Create required directories
RUN mkdir -p uploads reports static/uploads

# Create non-root user for security
RUN addgroup --system wildguard && adduser --system --ingroup wildguard wildguard
RUN chown -R wildguard:wildguard /app
USER wildguard

# Expose Flask port
EXPOSE 5001

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
  CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:5001/health')" || exit 1

# Start with Gunicorn (production WSGI server)
CMD ["gunicorn", \
     "--bind", "0.0.0.0:5001", \
     "--workers", "4", \
     "--worker-class", "sync", \
     "--timeout", "120", \
     "--log-level", "info", \
     "--access-logfile", "-", \
     "--error-logfile", "-", \
     "app:app"]