FROM python:3.14-slim AS builder

ENV PYTHONUNBUFFERED=1 \
    UV_SYSTEM_CERTS=1 \
    UV_PYTHON_DOWNLOADS=0 \
    UV_NO_MANAGED_PYTHON=1 \
    UV_SYSTEM_PYTHON=1 \
    UV_PROJECT_ENVIRONMENT=/usr/local \
    UV_COMPILE_BYTECODE=1 \
    UV_NO_DEV=1 \
    UV_LOCKED=1 \
    UV_LINK_MODE=copy

COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /bin/

WORKDIR /app

RUN --mount=type=cache,target=/root/.cache/uv \
    --mount=type=bind,source=zensical.toml,target=zensical.toml \
    --mount=type=bind,source=src/personal_mcp/docs/,target=src/personal_mcp/docs/ \
    uvx zensical build --clean --strict

RUN --mount=type=cache,target=/root/.cache/uv \
    --mount=type=bind,source=uv.lock,target=uv.lock \
    --mount=type=bind,source=pyproject.toml,target=pyproject.toml \
    uv sync --no-install-project

COPY pyproject.toml uv.lock README.md /app/
COPY ./src /app/src

RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync

FROM python:3.14-slim AS runtime

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

RUN groupadd --system --gid 1001 appuser && \
    useradd --system --uid 1001 --gid appuser appuser

WORKDIR /app

RUN chown appuser:appuser /app

COPY --from=builder --chown=appuser:appuser /usr/local/lib /usr/local/lib
COPY --from=builder --chown=appuser:appuser /usr/local/bin /usr/local/bin
COPY --from=builder --chown=appuser:appuser /app /app

USER appuser

ENTRYPOINT ["/usr/local/bin/personal-mcp"]