# AUTH.4C1 — c5-save-executor (SAVE-only, fail-closed, verdrahtet)
FROM python:3.11-slim
# Kein echtes Credential im Image. Kein produktiver Write ohne injiziertes
# TOLARIA_SAVE_TOKEN (env_file, 0600). SAVE-only: kein DELETE-Code.
# git wird für den Forgejo-Source-Loader (git show {commit}:{path}) benötigt.
RUN apt-get update && apt-get install -y --no-install-recommends git \
    && rm -rf /var/lib/apt/lists/*
RUN useradd --uid 10011 --create-home --shell /usr/sbin/nologin c5save
WORKDIR /app
COPY --chown=10011:10011 \
    save_executor_core.py \
    job_store.py \
    job_schema.py \
    job_state_machine.py \
    job_claim.py \
    tolaria_client.py \
    forgejo_source_loader.py \
    worker.py \
    entrypoint.py \
    /app/
USER 10011:10011
ENV C5_SAVE_DB=/data/c5a_save.db
# FIXED Tolaria Base URL (interne Docker-DNS-Adresse, NIE aus dem Job)
ENV C5_TOLARIA_BASE=http://tolaria:5173/api/vault
ENTRYPOINT ["python3", "/app/entrypoint.py"]