# Savi Comms broker — container image (Phase 2 of the productization build).
# The product's Linux deployment target and the installer's substrate.
#
# The container is the BROKER only.  Agent workspaces mount at /data/ai-resources
# and the store persists at /data/store;  the Claude credential arrives as a
# mounted keyfile named by SAVI_CLAUDE_CREDENTIALS_PATH (services/secret_source.py).
# Nothing secret bakes into the image.
#
# Build:  docker build -t savi-comms .
# Run:    docker run -p 127.0.0.1:8421:8421 \
#           -v comms-store:/data/store -v ./ai-resources:/data/ai-resources \
#           -v ./claude-creds.json:/run/secrets/claude-creds.json:ro \
#           -e SAVI_CLAUDE_CREDENTIALS_PATH=/run/secrets/claude-creds.json \
#           savi-comms

FROM python:3.12-slim

WORKDIR /app
COPY requirements.txt requirements-extras.txt ./
RUN pip install --no-cache-dir -r requirements.txt -r requirements-extras.txt

COPY . .

# Which release this image is.  The tree's RELEASE line is the one record of
# it (services/release_identity.py):  a distribution tree already carries one,
# and a VERSION build argument that disagrees with it refuses the build rather
# than naming the image one release while its code names another.  A source
# checkout carries none, so a VERSION given here is written into it, and with
# neither the image reports the checkout's base version.  The release is not
# copied into an environment variable, which would outrank the tree's own line.
# Called through -c rather than -m, so it runs where the module is compiled.
ARG VERSION=""
RUN python -c "import sys; from services import release_identity as r; sys.exit(r.main(sys.argv[1:]))" stamp /app "$VERSION"

ENV SAVI_COMMS_ROOT=/data/store \
    SAVI_AI_RESOURCES=/data/ai-resources

# Localhost-only binding is a host concern in a container:  the container
# binds all interfaces INSIDE its namespace and the publish flag above pins
# it to the host's loopback.  Design 6.2 / threat T2 still holds.
EXPOSE 8421
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8421"]
