# ---- stage 1: build the virtualenv, with uv
FROM ghcr.io/astral-sh/uv:python3.12-bookworm-slim \
     AS build-api
ENV UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy
WORKDIR /app
# dependencies only: cached until uv.lock changes
RUN --mount=type=cache,target=/root/.cache/uv \
    --mount=type=bind,source=uv.lock,target=uv.lock \
    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
    uv sync --locked --no-dev --no-install-project \
            --extra postgres
# the project: a code change rebuilds only this
COPY pyproject.toml uv.lock README.md ./
COPY src ./src
RUN uv sync --locked --no-dev --no-editable \
    --reinstall-package rating-platform --extra postgres

# ---- stage 2: the runtime image, no build tools
FROM python:3.12-slim-bookworm AS api
RUN useradd --create-home --uid 10001 app
WORKDIR /app
COPY --from=build-api --chown=app:app \
     /app/.venv /app/.venv
COPY --chown=app:app models ./models
ENV PATH="/app/.venv/bin:$PATH" \
    PYTHONUNBUFFERED=1 \
    RP_MODEL_DIR=/app/models/champion
USER app
EXPOSE 8000
HEALTHCHECK CMD python -c "import urllib.request as u; \
    u.urlopen('http://127.0.0.1:8000/health')"
CMD ["uvicorn", "rating_platform.api:app",
     "--host", "0.0.0.0", "--port", "8000"]

# naive
FROM python:3.12-slim-bookworm
WORKDIR /app
COPY . .
RUN pip install uv && \
    uv pip install --system ".[postgres,portal]"
ENV RP_API_KEY=prod-key-4f9a
CMD ["uvicorn", "rating_platform.api:app", ...]

$ docker inspect -f '{{json .Config.Env}}' l07-naive
["PATH=...", "PYTHON_VERSION=3.12.14", ...,
 "RP_API_KEY=prod-key-4f9a"]

$ docker history --no-trunc l07-naive | grep KEY
ENV RP_API_KEY=prod-key-4f9a

class Settings(BaseSettings):
    model_config = SettingsConfigDict(
        env_prefix="RP_", env_file=".env",
        secrets_dir="/run/secrets")   # when it exists

    database_url: str = "sqlite:///rating_platform.db"
    database_password: SecretStr | None = None
    model_dir: Path = Path("models/champion")
    liability_basis: Literal["manual", "model"] = "model"
    api_key: SecretStr = SecretStr("")
    api_url: str = ""
    target_loss_ratio: float = 0.68

    def sqlalchemy_url(self) -> URL:
        url = make_url(self.database_url)
        if self.database_password is not None:
            url = url.set(password=self.database_password
                                       .get_secret_value())
        return url

services:
  db:
    image: postgres:17-alpine
    environment: {POSTGRES_PASSWORD_FILE: /run/secrets/db_password}
    secrets: [db_password]
    volumes: [pgdata:/var/lib/postgresql/data]
  init:      # one-off: tables + the 2025 book, then exit
    image: rating-api:1.0.0
    command: [rating-platform, init-db, --book, /data/book_2025.csv]
    depends_on: {db: {condition: service_healthy}}
  api:
    build: {context: ., target: api}
    environment: {RP_DATABASE_URL: "postgresql+psycopg://rating@db/rating"}
    secrets: [{source: api_key, target: rp_api_key}, ...]
    ports: ["8000:8000"]
    depends_on: {init: {condition: service_completed_successfully}}
  portal:
    build: {context: ., target: portal}
    ports: ["8501:8501"]
    depends_on: {api: {condition: service_healthy}}
secrets:
  api_key: {file: ./secrets/api_key.txt}     # and db_password

$ docker compose up --build -d
 Container rating_platform-db-1      Healthy
 Container rating_platform-init-1    Exited
 Container rating_platform-api-1     Healthy
 Container rating_platform-portal-1  Started

$ docker compose logs init
loaded 18,249 vehicles into postgresql
(expected losses from glm-dcbe5b5dbb)

$ curl -s localhost:8000/health
{"status":"ok","model_version":"glm-dcbe5b5dbb",
 "database":"postgresql"}

$ docker compose exec api id
uid=10001(app) gid=10001(app) groups=10001(app)
$ docker compose exec api ls /run/secrets
rp_api_key  rp_database_password

• Stateless: the API keeps nothing on its own disk; quotes go to the database. Any number of copies can run behind a load balancer
• Configured by environment: the same image runs in test and production with different variables and secrets
• Observable: logs to standard output, a health endpoint, the model version on every quote
• Disposable: start in seconds, stop cleanly; replace rather than patch

• My images are multi-stage, dependencies before code
• Each service gets only the packages it needs
• Containers run as a non-root user with a health check
• I check that the running container has the code I built

• All configuration comes from the environment
• Secrets are mounted files, never in images, URLs, or Git
• Compose starts services in dependency order
• Data lives in volumes (or a managed database), not containers