Dockerfile

FROM python:3.12-slim

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1

# Create an unprivileged user up front so we can chown app dirs to it
# before dropping privileges with USER below. Fixed UID/GID 10001 so that
# bind-mounted volumes can be aligned on the host (chown 10001:10001).
RUN groupadd --system --gid 10001 spesobot \
 && useradd --system --uid 10001 --gid 10001 \
        --home-dir /app --no-create-home --shell /usr/sbin/nologin spesobot

WORKDIR /app

# Install runtime deps first for better layer caching (still as root so
# pip can write into site-packages).
COPY pyproject.toml README.md ./
COPY src ./src
COPY presets ./presets

RUN pip install --upgrade pip \
 && pip install .

# SQLite database lives in /app/data (mount a volume here). Pre-create
# the directory and hand /app over to the unprivileged user so the bot
# can write the DB file at runtime.
RUN mkdir -p /app/data \
 && chown -R spesobot:spesobot /app
VOLUME ["/app/data"]

ENV DATABASE_PATH=/app/data/spesobot.db

# Drop privileges. Everything from here on runs as uid 10001.
USER spesobot

CMD ["spesobot"]