# Dockerfile — Python runner for Day-3 Redaction & Monitoring lab
# Base image pinned by index-digest (ADR-6).
# Re-resolve: docker buildx imagetools inspect python:3.12-slim --format '{{.Manifest.Digest}}'
FROM python:3.12-slim@sha256:423ed6ab25b1921a477529254bfeeabf5855151dc2c3141699a1bfc852199fbf

WORKDIR /workspace

# curl: for debugging convenience (e.g. testing endpoints from inside the container).
RUN apt-get update \
    && apt-get install -y --no-install-recommends curl \
    && rm -rf /var/lib/apt/lists/*

# Step 1: Install Python dependencies.
# Presidio uses spaCy as the NLP backend — NO torch/HuggingFace required.
# spaCy wheels are pre-built for linux/amd64 (no gcc needed).
COPY app/requirements.txt ./requirements.txt
RUN pip install --no-cache-dir -r requirements.txt

# Step 2: Download the spaCy en_core_web_lg NER model at BUILD time.
#
# Why here: `spacy.load("en_core_web_lg")` and Presidio's AnalyzerEngine both
# require the model to be installed. `python -m spacy download en_core_web_lg`
# installs it as a Python package (pip wheel from GitHub releases, ~587 MB) into
# /usr/local/lib/python3.12/site-packages/en_core_web_lg/.
#
# At RUNTIME: spacy.load() finds the model in site-packages with NO network call —
# spaCy never re-downloads an installed model. Unlike HuggingFace, spaCy has no
# separate cache directory — the model IS the installed package (ADR-5).
RUN python -m spacy download en_core_web_lg

# Step 3: Validate the spaCy model and Presidio pipeline at BUILD time.
# Catches any version incompatibilities during pre-staging (not at demo time).
COPY app/prebake_spacy.py /tmp/prebake_spacy.py
RUN python /tmp/prebake_spacy.py && rm /tmp/prebake_spacy.py

# Bake app + data + prompts + worksheets so the image works standalone
# (compose mounts override at runtime)
COPY app/ ./app/
COPY data/ ./data/
COPY prompts/ ./prompts/
COPY worksheets/ ./worksheets/

CMD ["python", "app/injection_demo.py"]
