# NOTE: This hash is pinned to avoid version and environment differences.
FROM python:3.14.4-slim-trixie@sha256:538a18f1db92b4210a0b71aca2d14c156a96dedbe8867465c8ff4dce04d2ec39

WORKDIR /app

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY app.py app.py
COPY images images
COPY flag.txt /flag.txt

USER nobody

CMD python app.py