FROM python:3.14.10-slim AS beer_base_image

WORKDIR /beer_data

COPY requirements.txt .

# The runtime dependencies (flask, flask-wtf, waitress, pymongo, requests) all
# ship as wheels for 3.14, so no compiler toolchain is needed.  The old image
# installed libsasl2-dev, python-dev-is-python3, libldap2-dev and libssl-dev
# for packages that are no longer in the dependency list.
#
# The Python version matters:
#   - pymongo 4.19 requires Python >= 3.11, so the base image could not stay
#     on 3.10 once the requirements were pinned.
#   - 3.14 is a stable release (first released 2025-10-07, in its bugfix
#     phase until 2030-10), so the image is not carrying the CVEs fixed in
#     3.11, 3.12 and 3.13.
#   - The patch version is pinned rather than the floating `3.14-slim` tag so
#     a rebuild is reproducible and does not silently pick up a base image
#     change.
RUN pip install --upgrade pip --no-cache-dir

RUN pip --default-timeout=1000 install --no-cache-dir -r requirements.txt

# Fail the build if the interpreter is not the one the image claims.
RUN python -c "import sys; assert sys.version_info[:2] == (3, 14), sys.version"