| # syntax=docker/dockerfile:1 | |
| # First-party Docker image for the Sibyl Memory MCP server (stdio transport). | |
| # Non-root, pinned slim base, no secrets baked in. Storage lives on a mounted | |
| # volume at /home/app/.sibyl-memory. See sibyl-memory-mcp/README.md "Docker". | |
| FROM python:3.12-slim-bookworm # TODO: pin by digest before publish (no docker daemon in build env) | |
| # No build tools needed: sibyl-memory-mcp is pure Python and sqlite3 + FTS5 | |
| # ship in the stdlib. Keep the layer count and surface minimal. | |
| ENV PYTHONUNBUFFERED=1 \ | |
| PYTHONDONTWRITEBYTECODE=1 \ | |
| PIP_NO_CACHE_DIR=1 \ | |
| PIP_DISABLE_PIP_VERSION_CHECK=1 | |
| # Non-root runtime user with a real home for the default ~/.sibyl-memory path. | |
| RUN groupadd --gid 10001 app \ | |
| && useradd --uid 10001 --gid 10001 --create-home --home-dir /home/app app | |
| # Install the MCP server from the local monorepo source (first-party build, | |
| # not pulled from PyPI at image-build time). Copy only the two packages the | |
| # server needs, then pip install the mcp package which pulls its declared | |
| # deps (mcp, sibyl-memory-client, sibyl-memory-hermes) from PyPI. | |
| WORKDIR /app | |
| COPY sibyl-memory-mcp/ /app/sibyl-memory-mcp/ | |
| RUN pip install /app/sibyl-memory-mcp | |
| # Memory dir on the mounted volume, owned by the non-root user, mode 0700. | |
| RUN mkdir -p /home/app/.sibyl-memory \ | |
| && chown -R app:app /home/app/.sibyl-memory \ | |
| && chmod 700 /home/app/.sibyl-memory | |
| VOLUME ["/home/app/.sibyl-memory"] | |
| USER app | |
| ENV HOME=/home/app | |
| # stdio MCP server. Run attached with STDIN open (docker run -i), no TTY. | |
| ENTRYPOINT ["sibyl-memory-mcp"] | |