# Strategy Lab Python worker image
# - fetch: network-enabled; backtest: --network none
# - non-root uid 10001, read-only rootfs at runtime, /output writable only
FROM python:3.11-slim

ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PIP_NO_CACHE_DIR=1

WORKDIR /app

RUN adduser --uid 10001 --disabled-password --gecos "" worker

COPY requirements-worker.txt /tmp/requirements-worker.txt
RUN pip install --no-cache-dir -r /tmp/requirements-worker.txt

COPY worker /app/worker

USER worker

# /input request, /data dataset objects (read-only mounts); /output writable result dir
CMD ["python", "-m", "worker.main"]