Dockerfile.optimized

# Multi-Stage Dockerfile for Biometric Processor API
# Optimized for production with security, performance, and size considerations
# Following 2026 best practices for Python containerization

# ============================================================================
# Stage 1: Builder - Install dependencies and compile extensions
# ============================================================================
FROM python:3.13-slim as builder

# Build arguments
ARG PYTHON_VERSION=3.13
ARG DEBIAN_FRONTEND=noninteractive

# Set work directory
WORKDIR /build

# Install build dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    gcc \
    g++ \
    cmake \
    pkg-config \
    libglib2.0-0 \
    libsm6 \
    libxext6 \
    libxrender-dev \
    libgomp1 \
    libgl1 \
    git \
    && rm -rf /var/lib/apt/lists/*

# Create constraint file for compatibility
RUN echo "keras<3.0" > /tmp/constraints.txt

# Copy requirements
COPY requirements.txt .

# Create virtual environment for dependency isolation
ENV VIRTUAL_ENV=/opt/venv
RUN python -m venv $VIRTUAL_ENV
ENV PATH="$VIRTUAL_ENV/bin:$PATH"

# Upgrade pip and install build tools
RUN pip install --no-cache-dir --upgrade \
    pip>=25.1.1 \
    setuptools>=80.9.0 \
    wheel>=0.45.1

# Install dependencies in optimal order to prevent conflicts
# 1. Install numpy
RUN pip install --no-cache-dir -c /tmp/constraints.txt "numpy>=2.2.5"

# 2. Install opencv-python-headless first to claim cv2 namespace
RUN pip install --no-cache-dir -c /tmp/constraints.txt opencv-python-headless>=4.8.0

# 3. Install tensorflow-cpu (large dependency)
RUN pip install --no-cache-dir -c /tmp/constraints.txt tensorflow-cpu==2.21.0

# 4. Install deepface without dependencies to avoid conflicts
RUN pip install --no-cache-dir --no-deps deepface==0.0.98 && \
    pip install --no-cache-dir -c /tmp/constraints.txt lightphe lightdsa

# 5. Install remaining requirements
RUN pip install --no-cache-dir -c /tmp/constraints.txt -r requirements.txt

# 6. Force reinstall opencv-python-headless if opencv-python was installed
RUN pip uninstall -y opencv-python opencv-contrib-python 2>/dev/null || true && \
    pip install --no-cache-dir -c /tmp/constraints.txt --force-reinstall opencv-python-headless>=4.8.0

# Verify critical dependencies
RUN python -c "import cv2; print('OpenCV:', cv2.__version__)" && \
    python -c "import numpy; print('NumPy:', numpy.__version__)" && \
    python -c "import tensorflow; print('TensorFlow:', tensorflow.__version__)"

# ============================================================================
# Stage 2: Runtime - Minimal production image
# ============================================================================
FROM python:3.13-slim as runtime

# Metadata
LABEL maintainer="Biometric Processor Team"
LABEL version="1.0.0"
LABEL description="AI/ML microservice for face recognition and liveness detection"
LABEL org.opencontainers.image.source="https://github.com/yourusername/biometric-processor"

# Build arguments
ARG APP_USER=appuser
ARG APP_UID=1000
ARG APP_GID=1000

# Environment variables
ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PYTHONFAULTHANDLER=1 \
    PYTHONHASHSEED=random \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PIP_DEFAULT_TIMEOUT=100 \
    TF_CPP_MIN_LOG_LEVEL=2 \
    DEEPFACE_HOME=/tmp/.deepface \
    PORT=8080

# Install only runtime dependencies (no build tools)
RUN apt-get update && apt-get install -y --no-install-recommends \
    libglib2.0-0 \
    libsm6 \
    libxext6 \
    libxrender1 \
    libgomp1 \
    libgl1 \
    curl \
    ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && apt-get clean

# Create non-root user for security
RUN groupadd -g ${APP_GID} ${APP_USER} && \
    useradd -u ${APP_UID} -g ${APP_GID} -m -s /bin/bash ${APP_USER} && \
    mkdir -p /app /app/uploads /tmp/.deepface && \
    chown -R ${APP_USER}:${APP_USER} /app /tmp/.deepface

# Set work directory
WORKDIR /app

# Copy virtual environment from builder
COPY --from=builder --chown=${APP_USER}:${APP_USER} /opt/venv /opt/venv

# Copy application code
COPY --chown=${APP_USER}:${APP_USER} . .

# Set PATH to use virtual environment
ENV PATH="/opt/venv/bin:$PATH" \
    PYTHONPATH="/app:$PYTHONPATH"

# Create required directories with proper permissions
RUN chown -R ${APP_USER}:${APP_USER} /app

# Switch to non-root user
USER ${APP_USER}

# Expose port
EXPOSE 8080

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 \
    CMD curl --fail http://localhost:8080/api/v1/health || exit 1

# Start application
CMD ["python", "-m", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8080", "--workers", "1"]

# ============================================================================
# Stage 3: Development - With additional dev tools
# ============================================================================
FROM runtime as development

# Switch back to root to install dev tools
USER root

# Install development dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
    vim \
    less \
    procps \
    net-tools \
    iputils-ping \
    && rm -rf /var/lib/apt/lists/*

# Install development Python packages
RUN /opt/venv/bin/pip install --no-cache-dir \
    pytest==8.0.0 \
    pytest-asyncio==0.23.5 \
    pytest-cov==4.1.0 \
    black==24.2.0 \
    ruff==0.2.2 \
    mypy==1.8.0 \
    ipython==8.21.0 \
    debugpy==1.8.1

# Switch back to app user
USER ${APP_USER}

# Development server with hot reload
CMD ["python", "-m", "uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8080", "--reload"]