# =============================================================================
# Darwin Standards MCP Server Dockerfile
# Multi-stage build for minimal, secure production image
# =============================================================================
# =============================================================================
# Stage 1: Builder
# Installs dependencies and builds the application
# =============================================================================
FROM python:3.12-slim AS builder
# Install build dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
build-essential \
curl \
&& rm -rf /var/lib/apt/lists/*
WORKDIR /app
# Copy dependency files first (for layer caching)
COPY pyproject.toml README.md ./
COPY src/ ./src/
# Create virtual environment and install dependencies
RUN python -m venv /app/.venv
ENV PATH="/app/.venv/bin:$PATH"
# Install dependencies (using pip with trusted hosts for corporate proxy environments)
RUN pip install --no-cache-dir --trusted-host pypi.org --trusted-host pypi.python.org --trusted-host files.pythonhosted.org .
# =============================================================================
# Stage 2: Runtime
# Minimal production image with only runtime dependencies
# =============================================================================
FROM python:3.12-slim AS runtime
# Security: Create non-root user
RUN groupadd --gid 1000 mcp && \
useradd --uid 1000 --gid 1000 --create-home --shell /bin/bash mcp
WORKDIR /app
# Copy virtual environment from builder
COPY --from=builder --chown=mcp:mcp /app/.venv /app/.venv
ENV PATH="/app/.venv/bin:$PATH"
# Copy application code
COPY --chown=mcp:mcp src/ ./src/
# Environment configuration
ENV PYTHONDONTWRITEBYTECODE=1 \
PYTHONUNBUFFERED=1 \
PYTHONFAULTHANDLER=1 \
MCP_TRANSPORT=http \
MCP_PORT=8080 \
MCP_HOST=0.0.0.0 \
STANDARDS_PATH=/app/standards \
REFERENCE_IMPLEMENTATIONS_PATH=/app/reference-implementations
# Create directories for mounted volumes
RUN mkdir -p /app/standards /app/reference-implementations && \
chown -R mcp:mcp /app/standards /app/reference-implementations
# Security: Switch to non-root user
USER mcp
# Expose port
EXPOSE 8080
# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
CMD python -c "import socket; s=socket.socket(); s.settimeout(5); s.connect(('localhost', 8080)); s.close()" || exit 1
# Default command
ENTRYPOINT ["python", "-m", "standards_mcp_server.server"]
