# [H10.24] Container image for frootai-orchard-mcp (Python runtime)
#
# Self-host edition of the Orchard Harvest MCP server, Python runtime variant.
# Published to Docker Hub + GHCR as `frootaiio/orchard-mcp:<version>-py` (and
# `ghcr.io/frootai/orchard-mcp:<version>-py`). Byte-equal wire contract with the
# Node image.
#
# The harvest MCP package has ZERO runtime dependencies (stdlib only), so there
# is no `pip install` of third-party deps — we install the package itself from
# its pyproject and run the console script.
#
# Build context: this Dockerfile expects to be built from `frootai-core/`
# (one level above `python-mcp/orchard_server/`). Example:
#
#   cd frootai-core
#   docker build -f python-mcp/orchard_server/Dockerfile \
#     -t ghcr.io/frootai/orchard-mcp:0.1.0-py .
#
# Default mode: Streamable HTTP on 0.0.0.0:3000/mcp. For stdio mode, override
# the CMD at run time:
#   docker run -i --rm ghcr.io/frootai/orchard-mcp:0.1.0-py orchard-mcp

# ════════════════════════════════════════════════════════════════════════
# Stage 1 — build (install the package into a venv; no third-party deps)
# ════════════════════════════════════════════════════════════════════════
FROM python:3.13-alpine AS build

WORKDIR /build

COPY python-mcp/orchard_server/ ./python-mcp/orchard_server/

# Validate package layout — fail fast if any required file is missing.
RUN test -f ./python-mcp/orchard_server/pyproject.toml \
 && test -f ./python-mcp/orchard_server/frootai_orchard_mcp/__init__.py \
 && test -f ./python-mcp/orchard_server/frootai_orchard_mcp/bin.py \
 && test -f ./python-mcp/orchard_server/frootai_orchard_mcp/protocol.py

# Build a self-contained venv with the package installed (zero third-party deps).
RUN python -m venv /opt/venv \
 && /opt/venv/bin/pip install --no-cache-dir ./python-mcp/orchard_server

# ════════════════════════════════════════════════════════════════════════
# Stage 2 — runtime (minimal: just python + the venv)
# ════════════════════════════════════════════════════════════════════════
FROM python:3.13-alpine AS runtime

# ── Metadata ──────────────────────────────────────────────
LABEL org.opencontainers.image.source="https://github.com/frootai/frootai-core"
LABEL org.opencontainers.image.description="FrootAI Orchard Harvest MCP Server (Python) — 9 tools (discover/extract/retrieve/list + import/customize/re-harvest/approve/pending-reviews) over stdio + Streamable HTTP, self-host edition"
LABEL org.opencontainers.image.licenses="MIT"
LABEL org.opencontainers.image.version="0.1.0"
LABEL org.opencontainers.image.vendor="FrootAI"
LABEL org.opencontainers.image.title="frootai-orchard-mcp-py"
LABEL org.opencontainers.image.url="https://frootai.dev/docs/mcp/orchard"
LABEL org.opencontainers.image.documentation="https://frootai.dev/docs/mcp/orchard"

# ── Non-root user (UID 1001, GID 1001) ─────────────────────
RUN addgroup -g 1001 -S frootai \
 && adduser -S frootai -u 1001 -G frootai

WORKDIR /app

COPY --from=build --chown=frootai:frootai /opt/venv /opt/venv

USER frootai

# ── Environment defaults ─────────────────────────────────────
ENV PATH="/opt/venv/bin:$PATH"
ENV PYTHONUNBUFFERED=1
ENV PORT=3000
ENV HOST=0.0.0.0
ENV MCP_PATH=/mcp

# ── Health check (HTTP mode) ─────────────────────────────────
# Uses Python's stdlib urllib — no curl in the image.
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD python -c "import os,urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:'+os.environ.get('PORT','3000')+'/health',timeout=5).status==200 else 1)"

EXPOSE 3000

# ── Entry ─────────────────────────────────────────────────────
ENTRYPOINT ["orchard-mcp"]
CMD ["--http"]
