# Imported and verified from images.lock.json; never pull during production builds.
FROM cadworld-python-base:locked
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1 PIP_NO_CACHE_DIR=1
WORKDIR /app
COPY vendor/wheels/ /opt/wheels/
COPY deploy/cadworld/requirements.lock.txt /opt/requirements.lock.txt
RUN pip install --no-index --find-links=/opt/wheels --require-hashes -r /opt/requirements.lock.txt && pip check
COPY vendor/codex /usr/local/bin/codex
RUN chmod 755 /usr/local/bin/codex && codex --version && useradd --uid 10001 --no-create-home --shell /usr/sbin/nologin cadworld
COPY decision_server/ /app/decision_server/
# prepare_bundle.py includes only the three explicitly approved runtime contracts.
COPY contracts/ /app/contracts/
USER 10001:10001
ENTRYPOINT ["python", "-m", "decision_server"]