# Multi-stage build — final image is distroless for minimal attack surface.
FROM python:3.12-slim AS builder
WORKDIR /app
COPY pyproject.toml ./
COPY src ./src
RUN pip install --no-cache-dir --target /install fastapi 'uvicorn[standard]'
FROM gcr.io/distroless/python3-debian12
COPY --from=builder /install /usr/lib/python3.12/site-packages
COPY --from=builder /app/src /app/src
ENV PYTHONPATH=/app/src
WORKDIR /app
EXPOSE 8081
CMD ["-m", "uvicorn", "my_tool.main:app", "--host", "0.0.0.0", "--port", "8081"]