# syntax=docker/dockerfile:1
# Q+ Playground — local/container deployment image (NOT a public-facing security boundary).
#
# Build (from the accepted release tree; artifacts must already exist):
#   docker build -f deploy/playground/Dockerfile -t qplus-playground:local .
#
# Runtime (recommended: read-only rootfs + writable tmpfs for the run sandbox):
#   docker run --rm -p 127.0.0.1:8787:8787 \
#     --read-only --tmpfs /opt/qplus/site/.run:rw,noexec,nosuid,size=16m \
#     --tmpfs /tmp:rw,noexec,nosuid,size=32m \
#     --cap-drop ALL --security-opt no-new-privileges \
#     --memory 256m --cpus 1 --pids-limit 128 qplus-playground:local
#
# The image contains prebuilt release artifacts; it performs no network access at
# runtime. It is intended for trusted/internal demos only (see docs/PLAYGROUND_DEPLOY.md).

FROM python:3.12-slim

LABEL org.opencontainers.image.title="qplus-playground" \
      org.opencontainers.image.description="Q+ Playground (local dev tool; not a public security boundary)" \
      org.opencontainers.image.licenses="Apache-2.0" \
      org.opencontainers.image.source="https://example.invalid/qplus" \
      org.opencontainers.image.version="1.6.0-dev"

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    QPLUS_PLAYGROUND_PORT=8787

# Non-root runtime user; code is owned by root and read-only at runtime.
RUN groupadd --system qplus && \
    useradd --system --gid qplus --no-create-home --home-dir /nonexistent --shell /usr/sbin/nologin qplus && \
    mkdir -p /opt/qplus
WORKDIR /opt/qplus

# Release-tree runtime payload (prebuilt; no build/network during image build).
COPY --chown=root:root build/qboot.qbc build/bqvm ./build/
COPY --chown=root:root VERSION ./
COPY --chown=root:root docs ./docs
COPY --chown=root:root site/playground.py site/md2html.py site/build_site.py ./site/
COPY --chown=root:root site/content ./site/content
COPY --chown=root:root site/assets ./site/assets
COPY --chown=root:root stdlib ./stdlib

# Pre-generate the read-only documentation site (stdlib-only; no network).
RUN python3 site/build_site.py && \
    rm -rf site/__pycache__ site/ci && \
    mkdir -p site/.run && chown qplus:qplus site/.run && chmod 700 site/.run && \
    chmod -R a-w /opt/qplus && \
    chown -R root:root /opt/qplus

USER qplus
EXPOSE 8787

# stdlib-only health check (python:3.12-slim has no curl).
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
  CMD python3 -c "import sys,urllib.request; r=urllib.request.urlopen('http://127.0.0.1:8787/api/health', timeout=3); sys.exit(0 if r.status == 200 else 1)"

ENTRYPOINT ["python3", "site/playground.py", "--qplus-root", "/opt/qplus", "--host", "0.0.0.0", "--port", "8787"]
