# mirror — browser-only screen mirroring.
#
#   podman build -t mirror .
#   podman run --rm -p 8055:8055 mirror
#
# The image serves the app; it does not capture anything. Capture happens in the
# viewer's and sharer's own browsers, so there is no display, D-Bus, or PipeWire
# socket to pass in.
#
# Deliberately no HTTP client and no HEALTHCHECK: health checks belong to the
# deployment (see HealthCmd in the reeseapps/mirror quadlet), and shipping curl
# only to answer /healthz adds a package and a way for someone inside the
# container to make requests the image otherwise cannot make.

FROM docker.io/library/python:3.13-slim AS builder

ENV PIP_DISABLE_PIP_VERSION_CHECK=1 UV_LINK_MODE=copy
RUN pip install --no-cache-dir uv

WORKDIR /app
COPY pyproject.toml README.md ./
COPY src ./src
RUN uv venv /opt/venv \
 && uv pip install --python /opt/venv/bin/python --no-cache .


FROM docker.io/library/python:3.13-slim

LABEL org.opencontainers.image.title="mirror" \
      org.opencontainers.image.description="Browser-only screen mirroring for the local network" \
      org.opencontainers.image.source="https://gitea.reeseapps.com/experimental/mirror" \
      org.opencontainers.image.licenses="MIT"

COPY --from=builder /opt/venv /opt/venv
ENV PATH="/opt/venv/bin:${PATH}" \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    MIRROR_HOST=0.0.0.0 \
    MIRROR_PORT=8055

# Never run the web process as root.
RUN useradd --create-home --shell /usr/sbin/nologin mirror
USER mirror
WORKDIR /home/mirror

EXPOSE 8055

ENTRYPOINT ["mirror"]
CMD ["serve"]