# ndslive-mcp as a shared Streamable-HTTP service.
#
# Built from this checkout, so an unreleased branch can be run as-is:
#   docker build -t ndslive-mcp .
# Release images are built by GitHub Actions for linux/amd64 (the cluster's
# platform) and pushed to NDS Artifactory; see release.yml.
#
# Configuration is environment only (see `ndslive-mcp serve --help`):
#   NDS_ARTIFACTORY_USER / NDS_ARTIFACTORY_PAT   fetch and refresh the bundle
#   NDSLIVE_MCP_PUBLIC_URL, NDSLIVE_MCP_AUTH_*   require sign-in (Keycloak)
# Serving on 0.0.0.0 without NDSLIVE_MCP_AUTH_ISSUER is refused unless the
# command adds --no-auth. Extra arguments are appended to `serve`.
#
# Alpine: about 32 MB compressed against 58 MB on Debian slim, with the same
# Python, the same query latency (measured), and a shell for debugging. Every
# compiled dependency ships a musllinux wheel, so nothing is built from source.

FROM python:3.12-alpine AS build
COPY pyproject.toml README.md LICENSE /tmp/src/
COPY src /tmp/src/src
RUN python -m venv /opt/venv \
    && /opt/venv/bin/pip install --no-cache-dir /tmp/src \
    && /opt/venv/bin/pip uninstall -y pip

FROM python:3.12-alpine
ENV PATH=/opt/venv/bin:$PATH \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    # platformdirs puts the bundle cache under $XDG_CACHE_HOME/ndslive-mcp.
    XDG_CACHE_HOME=/var/cache
COPY --from=build /opt/venv /opt/venv
# No pip at runtime: nothing is installed after build, and less to patch.
RUN rm -rf /usr/local/lib/python3.12/site-packages/pip* /usr/local/bin/pip* \
    && adduser -S -D -H -u 10001 mcp \
    && mkdir -p /var/cache/ndslive-mcp && chown 10001 /var/cache/ndslive-mcp

# Numeric, so Kubernetes can verify runAsNonRoot.
USER 10001
VOLUME /var/cache/ndslive-mcp
EXPOSE 8000

HEALTHCHECK --interval=15s --timeout=3s --start-period=10s \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/healthz', timeout=2)"

ENTRYPOINT ["ndslive-mcp", "serve", "--transport", "http", "--host", "0.0.0.0", "--port", "8000"]
