# R-DOCKER: container image for the wanzi-codex provider / MCP server.
# Builds the package and runs the HTTP provider. No Cursor inside — this serves
# the provider surface (state under /data, mounted as a volume).
FROM python:3.12-slim AS build
WORKDIR /app
COPY pyproject.toml README.md LICENSE ./
COPY src ./src
RUN pip install --no-cache-dir --upgrade pip build \
    && pip wheel --no-cache-dir --no-deps -w /wheels .

FROM python:3.12-slim
LABEL org.opencontainers.image.title="wanzi-codex" \
      org.opencontainers.image.source="https://github.com/PandaHero/wanzi-codex"
WORKDIR /app
COPY --from=build /wheels /wheels
RUN pip install --no-cache-dir /wheels/*.whl && rm -rf /wheels

# Offline-by-default egress (R166); state lives in a mountable volume.
ENV WANZI_CODEX_HOME=/data \
    WANZI_CODEX_EGRESS_OFFLINE=1
RUN useradd -m -u 10001 wanzi && mkdir -p /data && chown wanzi /data
USER wanzi
VOLUME ["/data"]
EXPOSE 8765

# Override CMD to run the MCP server instead: ["wanzi-codex-mcp"].
ENTRYPOINT ["wanzi-codex-provider"]
CMD ["--host", "0.0.0.0", "--port", "8765", "--storage-root", "/data"]
