FROM python:3.12-slim

# Drop root for defence in depth — MCP server doesn't need elevated
# privileges, and containers often inherit pod-level securityContext that
# forbids root.
RUN useradd --create-home --shell /bin/bash mcp

# Build from this source tree, not from the published package.
#
# This used to be `pip install --no-cache-dir allure-testops-mcp` — unpinned, so
# every build resolved whatever was newest on PyPI at build time. That is the
# same open-ceiling failure that let `mcp` 2.0.0 break every fresh install on
# 2026-07-28, and pinning the line instead would only move the problem: the
# version would become a fourth place to keep in sync, after pyproject.toml and
# server.json's two fields — a drift this project already had to add a guard
# test for.
#
# Building from source removes the choice. The image is exactly the tree it was
# built from, and its version comes from pyproject.toml like everything else.
WORKDIR /src
COPY pyproject.toml README.md LICENSE ./
COPY src/ ./src/
RUN pip install --no-cache-dir . \
    && rm -rf /src

USER mcp
WORKDIR /home/mcp

ENTRYPOINT ["allure-testops-mcp"]
