FROM python:3.14-slim

WORKDIR /app

# Install uv
RUN pip install --no-cache-dir uv

# Install dependencies (separate layer for cache efficiency)
COPY pyproject.toml README.md ./
COPY steward/ steward/
RUN uv pip install --system --no-cache-dir .

# Create a non-root user (UID/GID 1000) and persistent data directory
RUN addgroup --gid 1000 steward \
    && adduser --uid 1000 --gid 1000 --no-create-home --disabled-password --gecos "" steward \
    && mkdir /data \
    && chown steward:steward /data

USER steward

# Default path for the thread memory store — override via env or docker-compose
ENV THREAD_MEMORY_PATH=/data/thread_memory.json

VOLUME ["/data"]

CMD ["steward"]