# mcp-defense runtime image.
#
# Slim by design — ships the proxy, policy engine, correlator, flight recorder,
# SIEM connectors, and the bundled archetypes. Node.js / MCP servers are NOT
# included; the most common integration pattern is an outer image that extends
# this one with whatever MCP server binaries you need (see README).
#
# Intended uses:
#   docker run --rm -it mcp-defense demo
#   docker run -p 8080:8080 mcp-defense sse --archetype github \
#       --agent-id claude-code --upstream http://host.docker.internal:9001 \
#       --bind 0.0.0.0:8080
#   docker run --network host mcp-defense bridge-tp --fifo /tmp/flows --interface eth0

FROM python:3.12-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1

RUN apt-get update && \
    apt-get install -y --no-install-recommends ca-certificates && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# Non-root runtime user.
RUN useradd -m -s /bin/bash -u 1000 mcp

WORKDIR /app

# Copy only the files pip install actually needs — keeps the build context
# small and layer caching predictable across code changes.
COPY pyproject.toml README.md LICENSE ./
COPY src/ ./src/

RUN pip install --upgrade pip && pip install .

USER mcp
WORKDIR /home/mcp

ENTRYPOINT ["mcp-defense"]
CMD ["--help"]
