Dockerfile

# Stage 1 — compile the Vue single-page application.
FROM node:22-slim AS frontend

WORKDIR /build
COPY frontend/package.json frontend/package-lock.json ./
RUN npm ci
COPY frontend/ ./
RUN npm run build

# Stage 2 — resolve the Python environment from the lock file.
FROM python:3.13-slim AS backend

COPY --from=ghcr.io/astral-sh/uv:0.11 /uv /usr/local/bin/uv
ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_PROJECT_ENVIRONMENT=/opt/venv

WORKDIR /build
COPY backend/pyproject.toml backend/uv.lock ./
RUN uv sync --frozen --no-dev --no-install-project

# Stage 3 — runtime image serving the API and the compiled front end.
FROM python:3.13-slim

RUN useradd --create-home --shell /usr/sbin/nologin portal

ENV PATH="/opt/venv/bin:$PATH" \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    APP_ENV=production

COPY --from=backend /opt/venv /opt/venv

WORKDIR /app
COPY backend/ /app/backend/
COPY --from=frontend /build/dist /app/frontend/dist

# Writable state: uploaded documents, generated exports, and monthly reports.
RUN mkdir -p /app/backend/instance /app/backend/uploads/resumes \
             /app/backend/uploads/offers /app/backend/exports /app/backend/reports \
    && chown -R portal:portal /app

USER portal
WORKDIR /app/backend
EXPOSE 5001

HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:5001/api/health').read()"

CMD ["gunicorn", "--bind", "0.0.0.0:5001", "--workers", "3", "--timeout", "60", \
     "--access-logfile", "-", "--error-logfile", "-", "wsgi:app"]