FROM python:3.11-slim-bookworm

LABEL io.modelcontextprotocol.server.name="io.github.jeannjohnson/arm-code-mcp"

# Install uv from the official distroless image
COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv

WORKDIR /app

# Copy dependency manifest first — layer cache invalidates only when these change
COPY pyproject.toml uv.lock ./
COPY src/ ./src/

# Install runtime dependencies only; skip building the local package so we
# don't need README.md or a built wheel at image-build time.
RUN uv sync --frozen --no-dev --no-install-project

# Activate the venv for all subsequent layers and at runtime
ENV VIRTUAL_ENV=/app/.venv
ENV PATH="/app/.venv/bin:$PATH"

# The source tree is already at /app/src — add it to PYTHONPATH so that
# `python -m arm_code_mcp` resolves the package without installing a wheel.
ENV PYTHONPATH=/app/src

# Pre-warm the embedding model at the pinned revision SHA.
ENV HF_HOME=/app/.cache/huggingface
ARG MODEL_REVISION=7dbbc90392e2f80f3d3c277d6e90027e55de9125
RUN python -c "\
from sentence_transformers import SentenceTransformer; \
SentenceTransformer('sentence-transformers/all-MiniLM-L6-v2', revision='$MODEL_REVISION'); \
print('Model pre-warmed at revision $MODEL_REVISION')"

# Create a non-root user (UID/GID 10001) and hand over /app ownership
RUN groupadd --gid 10001 appuser \
    && useradd --uid 10001 --gid 10001 --no-create-home --shell /sbin/nologin appuser \
    && chown -R appuser:appuser /app

USER appuser

# Runtime env vars — all can be overridden with -e / --env-file
ENV ARM_CODE_MCP_LOG_LEVEL=INFO
ENV ARM_CODE_MCP_CACHE_DIR=/app/.cache/arm-code-mcp

# Liveness check: verify the package imports cleanly
HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
    CMD python -c "import arm_code_mcp" || exit 1

ENTRYPOINT ["python", "-m", "arm_code_mcp"]
