FROM python:3.12-slim

COPY --from=ghcr.io/astral-sh/uv:0.8.17 /uv /uvx /bin/

RUN apt-get update \
    && apt-get install --no-install-recommends -y git \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

ENV VIRTUAL_ENV="/app/.venv"

COPY requirements.txt /app/requirements.txt

RUN uv venv "$VIRTUAL_ENV" && uv pip install -r /app/requirements.txt

# Deployment-owned OIDC OAuth-state storage factory. PyAirbyte resolves this
# module by name from `AIRBYTE_MCP_OIDC_CLIENT_STORAGE_FACTORY` (set by Pulumi),
# so it must be importable -- `PYTHONPATH=/app` puts it on `sys.path`.
COPY cloud_mcp_oidc_storage.py /app/cloud_mcp_oidc_storage.py

RUN useradd -m -u 10001 appuser \
    && chown -R appuser:appuser /app

ENV PATH="/app/.venv/bin:$PATH"
ENV PYTHONPATH="/app"

EXPOSE 8080

USER appuser

CMD ["airbyte-mcp-http"]
