FROM python:3.12-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1

WORKDIR /app

RUN adduser --system --no-create-home --uid 10001 --group owuitools

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Offline reference data, baked at build time so these lookups have no network
# dependency and no rate limit at all.
#
#   manuf  - Wireshark's OUI database. Preferred over IEEE's oui.csv because it
#            already merges the MA-L/MA-M/MA-S registries with explicit prefix
#            lengths (00:00:0C/24). Loading only the 24-bit registry silently
#            mis-attributes every address in a 28- or 36-bit block to whoever
#            owns the enclosing /24.
#   ports  - IANA service-name/port registry.
#
# Fetched here rather than at runtime because the running container has no
# route to either host. A failed download is not fatal: network_reference
# reports the dataset as unavailable and tells the model not to guess, which
# is better than refusing to start over a reference file.
COPY fetch_data.py .
RUN python fetch_data.py && rm fetch_data.py

COPY owuitools ./owuitools

USER owuitools

EXPOSE 8000

CMD ["uvicorn", "owuitools.main:app", "--host", "0.0.0.0", "--port", "8000", "--no-server-header"]