# Dockerfile — Python runner for the Day-3 Output-DLP-Gate lab
# Base image pinned by index-digest (ADR-6).
# Re-resolve: docker buildx imagetools inspect python:3.12-slim --format '{{.Manifest.Digest}}'
FROM python:3.12-slim@sha256:423ed6ab25b1921a477529254bfeeabf5855151dc2c3141699a1bfc852199fbf

WORKDIR /workspace

# curl: for debugging convenience (e.g. testing endpoints from inside the container).
RUN apt-get update \
    && apt-get install -y --no-install-recommends curl \
    && rm -rf /var/lib/apt/lists/*

# HF cache location (kept consistent build↔runtime). This lab bakes NO HuggingFace
# model — it uses only the NON-model llm-guard scanners — but HF_HOME + the offline
# flags below guarantee any transitive transformers import makes no network call.
ENV HF_HOME=/workspace/hf_cache

# Step 1: Install CPU-only PyTorch FIRST so pip does not pull the large GPU wheel
# when resolving llm-guard's torch dependency. (llm-guard needs torch even though
# THIS lab never instantiates a model-backed scanner.)
RUN pip install --no-cache-dir torch \
    --index-url https://download.pytorch.org/whl/cpu

# Step 2: Install remaining dependencies (torch already present; pip won't re-pull it).
COPY app/requirements.txt ./requirements.txt
RUN pip install --no-cache-dir -r requirements.txt

# Step 3: Download the spaCy en_core_web_lg NER model at BUILD time (pip package,
# ~587 MB). Presidio uses it offline — no HuggingFace, no runtime download.
RUN python -m spacy download en_core_web_lg

# Step 4: Set offline mode BEFORE the prebake so validation runs exactly as runtime.
ENV TRANSFORMERS_OFFLINE=1
ENV HF_HUB_OFFLINE=1

# Step 5: Validate spaCy + Presidio + the NON-model llm-guard scanners at BUILD time.
COPY app/prebake_spacy.py /tmp/prebake_spacy.py
RUN python /tmp/prebake_spacy.py && rm /tmp/prebake_spacy.py

# Bake app + data + prompts so the image works standalone (compose mounts override).
COPY app/ ./app/
COPY data/ ./data/
COPY prompts/ ./prompts/

CMD ["python", "app/dlp_gate.py"]
