FROM python:3.11-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

RUN apt-get update && apt-get install -y --no-install-recommends \
    tesseract-ocr \
    libtesseract-dev \
    libimage-exiftool-perl \
    ca-certificates \
  && rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY requirements.txt /app/requirements.txt
RUN pip install --no-cache-dir -r /app/requirements.txt

# Code + nicht-geheime Konfiguration ins Image (Secrets kommen zur Laufzeit via ENV).
COPY main.py /app/main.py
COPY config.yaml /app/config.yaml

# Haertung: nicht als root laufen.
RUN useradd --create-home --uid 10001 appuser
USER appuser

CMD ["python", "/app/main.py"]
