# syntax=docker/dockerfile:1.7
FROM python:3.13.14-slim@sha256:6771159cd4fa5d9bba1258caf0b82e6b73458c694d178ad97c5e925c2d0e1a91

COPY infrastructure/images/install-base-security-updates.sh /tmp/install-base-security-updates.sh
RUN sh /tmp/install-base-security-updates.sh \
    && rm /tmp/install-base-security-updates.sh

ARG GIT_REVISION
ARG GIT_SOURCE_TREE
ARG IMAGE_VERSION
ARG SOURCE_DATE_EPOCH
ARG BUILD_DATE

RUN groupadd --gid 10002 broker \
    && useradd --uid 10002 --gid 10002 --create-home --shell /usr/sbin/nologin broker

COPY services/docker_read_broker /opt/broker/docker_read_broker
COPY packages/__init__.py /opt/broker/packages/__init__.py
COPY packages/hub_runtime /opt/broker/packages/hub_runtime
RUN chown -R 10002:10002 /opt/broker

LABEL org.opencontainers.image.title="itworx-mcp-hub-docker-read-broker" \
      org.opencontainers.image.revision="${GIT_REVISION}" \
      org.opencontainers.image.source="https://gitea.example.com/jens/itworx-mcp-hub" \
      org.opencontainers.image.source-tree="${GIT_SOURCE_TREE}" \
      org.opencontainers.image.version="${IMAGE_VERSION}" \
      org.opencontainers.image.source-date-epoch="${SOURCE_DATE_EPOCH}" \
      org.opencontainers.image.created="${BUILD_DATE}" \
      org.opencontainers.image.vendor="ITWorx"

WORKDIR /opt/broker
USER 10002:10002
EXPOSE 8080
ENTRYPOINT ["python", "-m", "docker_read_broker.server"]