# Multi-stage build: resolution happens at build time, never at launch time
# (README §3, §13). The image is the distribution artifact.

FROM python:3.13-slim AS build
COPY --from=ghcr.io/astral-sh/uv:0.11.19 /uv /uvx /usr/local/bin/

WORKDIR /app
ENV UV_PROJECT_ENVIRONMENT=/app/.venv

COPY pyproject.toml uv.lock ./
RUN uv sync --frozen --no-dev --no-install-project

COPY README.md LICENSE ./
COPY src ./src
RUN uv sync --frozen --no-dev --no-editable


FROM python:3.13-slim
RUN useradd --create-home --shell /usr/sbin/nologin mcp

WORKDIR /app
COPY --from=build /app/.venv /app/.venv
ENV PATH="/app/.venv/bin:$PATH"

USER mcp

# stdio by default; set PG_MCP_TRANSPORT=http (and -p 8000:8000) for HTTP mode.
ENTRYPOINT ["kenning-pg-mcp"]
