FROM python:3.12-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    DATA_DIR=/data \
    PORT=5000

WORKDIR /app

# 用清华源加速，构建时不需要翻墙
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt \
      -i https://pypi.tuna.tsinghua.edu.cn/simple

COPY app.py .

RUN useradd -r -u 10001 blog && mkdir -p /data && chown -R blog /data /app
USER blog

EXPOSE 5000
CMD ["python", "app.py"]