# mcp-defense runtime image.
#
# Slim by design — ships the proxy, policy engine, correlator, flight recorder,
# SIEM connectors, and the bundled archetypes. Node.js / MCP servers are NOT
# included; the most common integration pattern is an outer image that extends
# this one with whatever MCP server binaries you need (see README).
#
# Build pattern: the wheel is built OUTSIDE the container (so hatch-vcs has
# access to git history for version derivation), then copied in and installed.
# This keeps the runtime image free of build deps and source tree.
#
# Local build:
#   make docker-build   (runs python -m build, then docker build)
#
# Intended uses:
#   docker run --rm -it mcp-defense demo
#   docker run -p 8080:8080 mcp-defense sse --archetype github \
#       --agent-id claude-code --upstream http://host.docker.internal:9001 \
#       --bind 0.0.0.0:8080
#   docker run --network host mcp-defense bridge-tp --fifo /tmp/flows --interface eth0

FROM python:3.12-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1

RUN apt-get update && \
    apt-get install -y --no-install-recommends ca-certificates && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# Non-root runtime user.
RUN useradd -m -s /bin/bash -u 1000 mcp

# Install the pre-built wheel. The build context's dist/ must contain
# exactly one mcp_defense wheel (produced by `python -m build --wheel`).
COPY dist/mcp_defense-*.whl /tmp/
RUN pip install --upgrade pip && \
    pip install /tmp/mcp_defense-*.whl && \
    rm /tmp/mcp_defense-*.whl

USER mcp
WORKDIR /home/mcp

ENTRYPOINT ["mcp-defense"]
CMD ["--help"]
