FROM python:3.12-slim
WORKDIR /app
ENV PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
# DJANGO_VERSION is empty for the "vulnerable" service (requirements.txt pins 5.2.5).
# The "upgraded-only" service reuses this exact app but overrides it with a patched release.
ARG DJANGO_VERSION=
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt \
    && if [ -n "$DJANGO_VERSION" ]; then pip install --no-cache-dir "Django==$DJANGO_VERSION"; fi \
    && python -c "import django; print('Django', django.__version__)"
COPY . .
EXPOSE 8000
CMD ["sh", "-c", "python manage.py migrate --noinput && python manage.py seed_demo_data && python manage.py runserver 0.0.0.0:8000"]
