# Security derivative of LibreTranslate 1.9.6. Upstream source and license are
# preserved in /app; the patched pyproject records the actual dependencies.
FROM libretranslate/libretranslate:v1.9.6@sha256:1de2d7056bb8ad607a412f4563d9abe324ff632b43b5be9428bcc8e213aebb32 AS upstream
FROM public.ecr.aws/docker/library/python:3.11.17-slim-bookworm@sha256:f06d01d4ba3f8ad5af45a3ec87df19c1d317d8e8961edc0fabda61811af6f7cf
USER root
RUN apt-get update -qq && apt-get upgrade -y && apt-get clean
ENV HOME=/home/libretranslate
RUN groupadd --gid 1032 libretranslate && useradd --uid 1032 --gid 1032 --create-home --shell /usr/sbin/nologin libretranslate
COPY --from=upstream --chown=1032:1032 /app /app
WORKDIR /app
COPY patch-dependencies.py /tmp/patch-dependencies.py
ARG PIP_BOOTSTRAP=https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl#sha256=fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70
RUN python /tmp/patch-dependencies.py && \
    python -m pip install --no-cache-dir --upgrade "pip @ $PIP_BOOTSTRAP" && \
    ./venv/bin/python -m pip install --no-cache-dir --upgrade "pip @ $PIP_BOOTSTRAP" && \
    ./venv/bin/python -m pip install --no-cache-dir --upgrade certifi==2026.10.19 && \
    ./venv/bin/python -m pip install --no-cache-dir --upgrade . setuptools==83.0.0 urllib3==2.8.0 soupsieve==2.9.0 && \
    ./venv/bin/python -m pip check && \
    ./venv/bin/python -c "import sys,ssl,pyexpat; print(sys.version,ssl.OPENSSL_VERSION,pyexpat.EXPAT_VERSION)" && \
    mkdir -p /home/libretranslate/.local && chown -R 1032:1032 /home/libretranslate /app
USER libretranslate
EXPOSE 5000
ENTRYPOINT ["./scripts/entrypoint.sh"]
