# The harness host. Build from the repository root, with the version from git (the build context has no .git):
#   docker build -f packages/harness-host/Dockerfile -t harness-host \
#     --build-arg HARNESS_VERSION="$(uv run python scripts/versions.py python)" .
# Dependencies come from uv.lock, so the image has exactly the versions the tests ran with.

FROM python:3.12-slim-bookworm AS build
COPY --from=ghcr.io/astral-sh/uv:0.9.10 /uv /usr/local/bin/uv
ARG HARNESS_VERSION
RUN test -n "$HARNESS_VERSION" || (echo "pass --build-arg HARNESS_VERSION (scripts/versions.py python)" && exit 1)
# hatch-vcs reads the version from git; without .git it takes this one.
ENV SETUPTOOLS_SCM_PRETEND_VERSION=${HARNESS_VERSION}
WORKDIR /src
COPY pyproject.toml uv.lock ./
COPY packages ./packages
COPY samples ./samples
RUN uv export --frozen --no-dev --package harness-host --no-emit-workspace --no-hashes -o /out/requirements.txt \
 && uv build --package harness --wheel --out-dir /out/wheels \
 && uv build --package harness-host --wheel --out-dir /out/wheels

FROM python:3.12-slim-bookworm
ARG HARNESS_VERSION
LABEL org.opencontainers.image.title="harness-host" \
      org.opencontainers.image.version="${HARNESS_VERSION}" \
      org.opencontainers.image.source="https://git.knurz.com/developer/harness"
RUN useradd --uid 10001 --create-home --shell /usr/sbin/nologin harness
COPY --from=build /out /tmp/out
RUN pip install --no-cache-dir -r /tmp/out/requirements.txt \
 && pip install --no-cache-dir --no-deps /tmp/out/wheels/*.whl \
 && rm -rf /tmp/out
USER 10001
ENV HARNESS_HOST_BIND=0.0.0.0 \
    HARNESS_HOST_PORT=8080 \
    PYTHONUNBUFFERED=1
EXPOSE 8080
CMD ["harness-host"]
