FROM python:3.11-slim

WORKDIR /app

# System deps + solc + Foundry + Tini (consolidated for smaller layer)
RUN apt-get update && apt-get install -y --no-install-recommends \
    gcc libpq-dev curl git ca-certificates && \
    curl -sL https://github.com/krallin/tini/releases/download/v0.19.0/tini -o /tini && \
    chmod +x /tini && \
    rm -rf /var/lib/apt/lists/* /var/cache/apt/archives/*

# Solidity compiler (kept — used by contract scanners)
RUN curl -sL https://github.com/ethereum/solidity/releases/download/v0.8.26/solc-static-linux -o /usr/local/bin/solc && \
    chmod +x /usr/local/bin/solc

# Foundry (cast, forge) — EVM contract analysis
RUN curl -sL https://foundry.paradigm.xyz | bash && \
    export PATH="$HOME/.foundry/bin:$PATH" && \
    foundryup

# Python deps (ordered for layer caching: requirements first, then app)
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt && \
    pip install --no-cache-dir slither-analyzer && \
    rm -rf /root/.cache/pip

# Copy app (HF models excluded via .dockerignore — they download at runtime)
COPY . .

# Health check (uses /live for liveness, not /ready)
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
    CMD curl -f http://localhost:8000/live || exit 1

EXPOSE 8000

# Use Tini as PID 1 to properly reap zombie processes and forward signals
ENTRYPOINT ["/tini", "--"]
CMD ["python", "-u", "main.py"]