clearcutt-python3.14 : distroless

# Stage 1: Build virtualenv using the dev builder image
FROM ghcr.io/northcutted/clearcutt/clearcutt-python3.14:v0.6.3-dev AS builder
WORKDIR /app

# Set up virtualenv
RUN python -m venv /opt/venv
ENV PATH="/opt/venv/bin:$PATH"

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Stage 2: Hardened runner stage (distroless or slim JRE/Python runtime)
FROM ghcr.io/northcutted/clearcutt/clearcutt-python3.14:v0.6.3-distroless
WORKDIR /app

# Copy virtualenv and application code
COPY --from=builder /opt/venv /opt/venv
COPY . .

# Set environment and execute as secure non-root operator
ENV PATH="/opt/venv/bin:$PATH"
ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONUNBUFFERED=1

USER 10001:10001
CMD ["python", "app.py"]

# Run an interactive local dev shell with the exact same remediated Python interpreter:
$ nix shell github:northcutted/clearcutt-images/v0.6.3#clearcuttPython314-native

# Or import inside your local flake.nix devShell overlay:
{
  inputs.clearcutt.url = "github:northcutted/clearcutt-images/v0.6.3";
  outputs = { self, nixpkgs, clearcutt }: {
    devShells.x86_64-linux.default = let
      pkgs = import nixpkgs {
        system = "x86_64-linux";
        overlays = [ clearcutt.overlays.default ];
      };
    in pkgs.mkShell {
      buildInputs = [ pkgs.clearcuttPython314 ];
    };
  };
}

# Build a custom OCI image by layering extra packages in your Nix config
pkgs.dockerTools.buildImage {
  name = "custom-python-service";
  tag = "latest";
  
  # Layer on top of ClearCutt's base
  fromImage = clearcutt-base-image;
  
  copyToRoot = pkgs.buildEnv {
    name = "image-root";
    paths = [
      pkgs.ffmpeg           # Layer in extra tools declaratively
      python-application    # Include your compiled python build
    ];
    pathsToLink = [ "/bin" "/lib" ];
  };

  config = {
    Cmd = [ "/bin/app" ];
    User = "10001:10001";
  };
}