5. Đóng Gói Docker Chuẩn Production: Multi-Stage Build, User Non-Root & Xử Lý Tín Hiệu PID 1

# DOCKERFILE MULTI-STAGE CHUẨN PRODUCTION CHO PYTHON FLASK
FROM python:3.12-alpine AS base
WORKDIR /app
RUN apk add --no-cache libpq dumb-init curl

# Stage Builder
FROM base AS builder
RUN apk add --no-cache gcc musl-dev postgresql-dev
COPY requirements.txt .
RUN pip install --no-cache-dir --user -r requirements.txt

# Stage Runner (Non-Root)
FROM base AS runner
WORKDIR /app
ENV PATH=/home/appuser/.local/bin:$PATH
ENV PYTHONUNBUFFERED=1

RUN addgroup -g 1001 -S appgroup && adduser -u 1001 -S appuser -G appgroup
COPY --from=builder --chown=appuser:appgroup /root/.local /home/appuser/.local
COPY --chown=appuser:appgroup . .

USER appuser
EXPOSE 5000

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3   CMD curl -f http://localhost:5000/healthz || exit 1

ENTRYPOINT ["dumb-init", "--"]
CMD ["gunicorn", "--bind", "0.0.0.0:5000", "--workers", "3", "app:app"]