# awm-worker execution plane (Docker)
# Build context: staging dir from scripts-dev/build/build-worker-docker-archive.sh
#   (WORKER tree + awm_core/)

ARG AWM_WORKER_BASE_IMAGE=python:3.12-slim-bookworm
FROM ${AWM_WORKER_BASE_IMAGE}

LABEL org.opencontainers.image.title="awm-worker" \
      org.opencontainers.image.description="AWM execution worker"

RUN apt-get update \
    && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
        ansible \
        openssh-client \
        rsync \
        ca-certificates \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /opt/awm-worker

COPY . /opt/awm-worker/

RUN pip install --no-cache-dir -e . \
    && groupadd -r awm-worker 2>/dev/null || true \
    && useradd -r -g awm-worker -d /var/lib/awm-worker -s /usr/sbin/nologin awm-worker 2>/dev/null || true \
    && mkdir -p /var/lib/awm-worker /var/log/awm-worker \
    && chown -R awm-worker:awm-worker /var/lib/awm-worker /var/log/awm-worker

ENV PYTHONPATH=/opt/awm-worker/awm_core:/opt/awm-worker \
    AWM_WORKER_ENV_FILE=/var/lib/awm-worker/worker.env \
    AWM_WORKER_TOKEN_FILE=/var/lib/awm-worker/worker.token \
    AWM_WORKER_LOG_FILE=/var/log/awm-worker/worker.log

USER awm-worker

ENTRYPOINT ["awm-worker"]
CMD ["run", "--config", "/var/lib/awm-worker/worker.env"]
