# syntax=docker/dockerfile:1
#
# Production image for the streamable MCP HTTP gateway (`dattos-mcp-http`).
#
# Build prerequisite: the `dattos` wheel must exist under `dist/`. Generate it
# with `python -m build --wheel` before running `docker build`. The wheel is
# installed *without* its transitive deps (`--no-deps`) on top of the locked
# runtime requirements so the lock file remains hash-verified.
#
FROM python:3.12-slim AS base
WORKDIR /app

# 1) Install transitive runtime deps from the locked requirements (hashed).
COPY requirements.lock /tmp/requirements.lock
RUN pip install --no-cache-dir --require-hashes -r /tmp/requirements.lock \
    && rm /tmp/requirements.lock

# 2) Install the dattos wheel itself (no-deps; deps already satisfied above).
COPY dist/dattos-1.5.0-py3-none-any.whl /tmp/dattos-1.5.0-py3-none-any.whl
RUN pip install --no-cache-dir --no-deps /tmp/dattos-1.5.0-py3-none-any.whl \
    && rm /tmp/dattos-1.5.0-py3-none-any.whl

# Non-root user; uvicorn doesn't need root.
RUN useradd --create-home --uid 1000 dattos
USER dattos

ENV HOST=0.0.0.0 PORT=8000 LOG_LEVEL=info
EXPOSE 8000

# The console script is installed by the wheel; just invoke it.
CMD ["dattos-mcp-http"]
