# Hugging Face Spaces Dockerfile for fabric-config-oracle MCP server.
#
# HF Spaces convention:
#   - Listen on port 7860 (HF proxies public traffic here).
#   - Run as non-root user `user` (uid 1000) — HF enforces this.
#   - Use a slim Python base image to keep the layer small.
#
# After the Space is up, the public MCP endpoint is:
#   https://<your-space-name>.hf.space/mcp

FROM python:3.12-slim

# Avoid Python writing .pyc files and forcing stdout/stderr to be unbuffered.
ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    FASTMCP_HOST=0.0.0.0 \
    FASTMCP_PORT=7860

# Create the non-root user HF Spaces requires.
RUN useradd --create-home --uid 1000 user

WORKDIR /home/user/app

# Install Python deps first (better Docker layer caching).
# Copy just the requirements file, install as root, then drop privileges.
COPY --chown=user:user requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

# Copy the rest of the source.
COPY --chown=user:user . .

# Switch to the non-root user.
USER user

# HF Spaces expects the container to listen on 7860.
EXPOSE 7860

# Healthcheck — a 200 from the MCP endpoint means the server is up.
# Streamable HTTP returns 406 to non-MCP requests, so we just check
# that *something* responds (any HTTP status is OK; timeout means dead).
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
    CMD python -c "import urllib.request, sys; \
    try: urllib.request.urlopen('http://127.0.0.1:7860/mcp', timeout=3); \
    except Exception: sys.exit(0); sys.exit(0)"

# Run the HTTP entry point.
CMD ["python", "app.py"]