# Minimal non-root image for mcp-argocd.
#
#   docker build -t mcp-argocd .
#
# Run (stdio; the image defaults to locked read-only — pass
# -e MCP_READ_ONLY=false to allow writes):
#   docker run --rm -i \
#     -e ARGOCD_URL=https://argocd.example.com \
#     -e ARGOCD_TOKEN=<token> \
#     mcp-argocd
#
# Serve over HTTP (requires a bearer token on a non-loopback host):
#   docker run --rm -p 9000:9000 \
#     -e ARGOCD_URL=... -e ARGOCD_TOKEN=... \
#     -e ARGOCD_HTTP_BEARER_TOKEN=$(openssl rand -hex 32) \
#     mcp-argocd --transport streamable-http --host 0.0.0.0 --port 9000
FROM python:3.13-slim

# uv provides reproducible, frozen installs from uv.lock.
COPY --from=ghcr.io/astral-sh/uv:0.9.2 /uv /uvx /bin/

ENV UV_COMPILE_BYTECODE=1 \
    UV_LINK_MODE=copy \
    UV_PYTHON_DOWNLOADS=never \
    PATH="/app/.venv/bin:$PATH"

WORKDIR /app

COPY pyproject.toml uv.lock README.md ./
COPY src ./src
RUN uv sync --frozen --no-dev

# Drop privileges: run as a non-root user that owns the venv.
RUN useradd --create-home --uid 10001 app && chown -R app:app /app
USER app

# Default to the locked read-only mode; override with `-e MCP_READ_ONLY=false`
# at `docker run` to allow writes.
ENV MCP_READ_ONLY=true

ENTRYPOINT ["mcp-argocd"]
CMD []
