initial commit. phase 1 complete

backend/Dockerfile

@@ -0,0 +1,64 @@
+# =============================================================================
+# LabGraph — Multi-stage Dockerfile
+# Stages: base → development → production
+# docker-compose uses target: development for all services
+# =============================================================================
+
+# -----------------------------------------------------------------------------
+# base — shared OS deps, non-root user, Python dependencies
+# -----------------------------------------------------------------------------
+FROM python:3.12-slim AS base
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1
+
+# curl: required by docker-compose web healthcheck (curl http://localhost:8000/api/health/)
+# nmap: required by python-nmap discovery tasks (Phase 2)
+# libpq-dev + build-essential: required to compile psycopg[binary]
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    libpq-dev \
+    curl \
+    nmap \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN groupadd --gid 1000 appuser && \
+    useradd --uid 1000 --gid appuser --shell /bin/bash --create-home appuser
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install -r requirements.txt
+
+# -----------------------------------------------------------------------------
+# development — volume-mounted source, no CMD (docker-compose provides it)
+# -----------------------------------------------------------------------------
+FROM base AS development
+
+RUN pip install watchdog
+
+EXPOSE 8000
+
+# -----------------------------------------------------------------------------
+# production — source baked in, runs as non-root, gunicorn CMD
+# -----------------------------------------------------------------------------
+FROM base AS production
+
+COPY . .
+
+RUN python manage.py collectstatic --noinput
+
+USER appuser
+
+EXPOSE 8000
+
+CMD ["gunicorn", "config.wsgi:application", \
+     "--bind", "0.0.0.0:8000", \
+     "--workers", "4", \
+     "--worker-class", "gthread", \
+     "--threads", "2", \
+     "--timeout", "120", \
+     "--access-logfile", "-", \
+     "--error-logfile", "-"]