# Python 3.13.16, official multi-platform image, verified 2026-10-14.
FROM python:3.13.16-slim-bookworm@sha256:a1165e272e578941b84abc79e4ab38a0305cd12803a5c4247979ac7655f4d641
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
WORKDIR /app
COPY . /app/
# Workstation assets may be owner-only; the unprivileged API must read public files.
RUN chmod -R a+rX /app && mkdir /data && chown 10001:10001 /data
USER 10001:10001
EXPOSE 8765
CMD ["python", "-m", "oskz.server", "--bind", "0.0.0.0", "--db", "/data/oskz.sqlite3"]
