# Base image pinned by multi-arch manifest-list (index) digest (F-6). Tag kept for
# readability; the digest is enforced. Renovate bumps it (F-6 Phase 4).
ARG PY_IMAGE=python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9

# ---------------------------------------------------------------------------
# Stage 1: Build — install the package + deps; build artifacts stay out of runtime.
# ---------------------------------------------------------------------------
FROM ${PY_IMAGE} AS builder

WORKDIR /app
ENV PYTHONUNBUFFERED=1
ENV PYTHONDONTWRITEBYTECODE=1

COPY pyproject.toml .
COPY src/ src/
RUN pip install --no-cache-dir .

# ---------------------------------------------------------------------------
# Stage 2: Runtime — non-root, only the installed package + deps (no source/pyproject).
# ---------------------------------------------------------------------------
FROM ${PY_IMAGE} AS runtime

WORKDIR /app
ENV PYTHONUNBUFFERED=1
ENV PYTHONDONTWRITEBYTECODE=1

# Non-root user (F-6). uid/gid 1001 mirrors the other services.
RUN groupadd --gid 1001 inedge && \
    useradd --uid 1001 --gid 1001 --no-create-home --shell /bin/false inedge

COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
COPY --from=builder /usr/local/bin /usr/local/bin

USER 1001

EXPOSE 8100

# FastMCP serves SSE on 8100 with no HTTP /health route, so liveness is a TCP connect
# (stdlib, no curl dep). Docker/compose parity only — K8s probes remain authoritative.
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
    CMD ["python", "-c", "import socket; socket.create_connection(('127.0.0.1', 8100), timeout=3).close()"]

CMD ["python", "-m", "inedge_mcp"]
