# Minimal, non-root, distroless-style image: small attack surface = fewer CVEs to gate on.
FROM public.ecr.aws/docker/library/python:3.12-slim AS build
WORKDIR /app
COPY app.py .

FROM gcr.io/distroless/python3-debian12:nonroot
WORKDIR /app
COPY --from=build /app/app.py .
EXPOSE 8080
USER nonroot
ENTRYPOINT ["python3", "app.py"]
