# syntax=docker/dockerfile:1.7
#
# Multi-stage Dockerfile for power-hmc-mcp.
#
# Stage 1 (builder): pip-installs the project into an isolated /app/install
# tree using the same `pip install .` path the operator would use locally.
# Stage 2 (runtime): copies the install tree into a slim base image, drops
# privileges, and runs the MCP server. No build tooling, no compilers, and
# no .git in the runtime layer — only what is needed to invoke
# `python -m power_hmc_mcp.mcp_server`.
#
# Defaults:
#   * Bind to 127.0.0.1 (loopback only). Front with NGINX/Envoy/ingress
#     for any non-trivial deployment — see examples/deploy/ and
#     docs/transports.md.
#   * Probes are OFF by default. Set HMC_MCP_HTTP_PROBES_PATH=/ to enable
#     /healthz + /readyz on the listener.
#   * Demo mode is off; HMC_HOST/USERNAME/PASSWORD are required at runtime.
#
# Tags published in CI (D6 matrix):
#   * power-hmc-mcp:<version>            — release tag
#   * power-hmc-mcp:<version>-py3.12     — explicit Python pin
#   * power-hmc-mcp:dev                  — main-branch HEAD

# ---- builder ---------------------------------------------------------------

FROM python:3.12-slim-bookworm AS builder

ENV PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

WORKDIR /src

# Layer the dependency-defining files first so editing source code does not
# bust the dependency-install cache.
COPY pyproject.toml README.md LICENSE ./
COPY src/ ./src/

# Install into /app/install — a self-contained prefix we can copy into the
# runtime stage. `--no-deps` would leave us without runtime deps; we install
# the package + its declared deps. Dev extras are NOT installed.
RUN python -m pip install --upgrade pip && \
    python -m pip install --prefix=/app/install .

# ---- runtime ---------------------------------------------------------------

FROM python:3.12-slim-bookworm AS runtime

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    HMC_MCP_TRANSPORT=streamable-http \
    HMC_MCP_HTTP_HOST=127.0.0.1 \
    HMC_MCP_HTTP_PORT=8000 \
    HMC_MCP_HTTP_PATH=/mcp \
    HMC_LOG_JSON=true

# Keep the runtime layer minimal. tini gives us PID 1 signal handling for
# graceful HMC logoff on container stop.
RUN apt-get update \
    && apt-get install -y --no-install-recommends tini ca-certificates \
    && rm -rf /var/lib/apt/lists/*

# Drop privileges. UID/GID 10001 is arbitrary but matches what most
# Kubernetes pod-security baselines (PSA restricted, OpenShift SCC) accept
# without further allowance.
RUN groupadd --system --gid 10001 power-hmc-mcp \
    && useradd --system --uid 10001 --gid 10001 --home-dir /app --shell /sbin/nologin power-hmc-mcp

COPY --from=builder /app/install /usr/local

USER 10001:10001
WORKDIR /app

# Container-level liveness/readiness use the same HTTP probes the application
# exposes via HMC_MCP_HTTP_PROBES_PATH. Operators that disable probes via env
# can still rely on the streamable-HTTP listener answering on /mcp; the
# Helm chart's `livenessProbe` is configurable per-deployment.
EXPOSE 8000

ENTRYPOINT ["/usr/bin/tini", "--", "python", "-m", "power_hmc_mcp.mcp_server"]
