freecad-robust-mcp-fc111/Dockerfile

# syntax=docker/dockerfile:1.7

# FreeCAD Robust MCP Server Dockerfile
# Multi-stage build with BuildKit optimizations for multi-arch support
#
# Uses Alpine Linux for minimal image size and reduced CVE surface.
# Alpine has significantly fewer vulnerabilities than Debian-based images.
#
# Build:
#   docker build -t freecad-mcp .
#
# Build multi-arch:
#   docker buildx build --platform linux/amd64,linux/arm64 -t freecad-mcp .
#
# Run:
#   docker run --rm -i freecad-mcp

# =============================================================================
# Stage 1: Builder - Install dependencies and build the package
# =============================================================================
FROM python:3.11-alpine AS builder

# Install build dependencies for compiling Python packages with native extensions
# hadolint ignore=DL3018
RUN apk add --no-cache \
    build-base \
    libffi-dev

# Set up working directory
WORKDIR /app

# Upgrade pip to fix CVE-2025-8869, then install uv for fast dependency management
# hadolint ignore=DL3013
RUN --mount=type=cache,target=/root/.cache/pip \
    pip install --no-cache-dir --upgrade "pip>=25.3" && \
    pip install --no-cache-dir --no-compile uv

# Copy only dependency files first for better layer caching
COPY pyproject.toml README.md ./
COPY src/ ./src/

# Version for setuptools-scm when building without git (e.g., in Docker)
# This can be overridden at build time with --build-arg VERSION=x.y.z
ARG VERSION=0.0.0.dev0
ENV SETUPTOOLS_SCM_PRETEND_VERSION=${VERSION}

# Create virtual environment and install dependencies
# Using uv cache mount for faster rebuilds
RUN --mount=type=cache,target=/root/.cache/uv \
    uv venv /opt/venv && \
    . /opt/venv/bin/activate && \
    uv pip install --no-compile .

# =============================================================================
# Stage 2: Runtime - Minimal image for running the server
# =============================================================================
FROM python:3.11-alpine AS runtime

# Labels for container metadata (OCI Image Spec)
# Note: version, revision, and created are set dynamically in CI/CD workflows
LABEL org.opencontainers.image.title="FreeCAD Robust MCP Server" \
      org.opencontainers.image.description="Robust MCP Server for FreeCAD integration with AI assistants" \
      org.opencontainers.image.url="https://github.com/spkane/freecad-robust-mcp-and-more" \
      org.opencontainers.image.source="https://github.com/spkane/freecad-robust-mcp-and-more" \
      org.opencontainers.image.documentation="https://github.com/spkane/freecad-robust-mcp-and-more#readme" \
      org.opencontainers.image.licenses="MIT" \
      org.opencontainers.image.vendor="Sean P. Kane" \
      org.opencontainers.image.authors="Sean P. Kane <spkane@gmail.com>" \
      org.opencontainers.image.base.name="python:3.11-alpine"

# Create non-root user for security (Alpine uses addgroup/adduser)
RUN addgroup -g 1000 mcpuser && \
    adduser -u 1000 -G mcpuser -s /bin/sh -D mcpuser

# Upgrade system pip to fix CVE-2025-8869 (defense-in-depth)
# Note: Although PATH prefers /opt/venv/bin, we upgrade the system pip at
# /usr/local/bin/pip intentionally. This ensures no vulnerable pip exists
# in the image, even if the venv is bypassed or pip is invoked directly.
# hadolint ignore=DL3013
RUN pip install --no-cache-dir --upgrade "pip>=25.3"

# Copy virtual environment from builder
COPY --from=builder /opt/venv /opt/venv

# Set environment variables
ENV PATH="/opt/venv/bin:$PATH" \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    # Default to xmlrpc mode (requires FreeCAD running externally)
    FREECAD_MODE="xmlrpc" \
    FREECAD_SOCKET_HOST="host.docker.internal" \
    FREECAD_SOCKET_PORT="9876" \
    FREECAD_XMLRPC_PORT="9875" \
    FREECAD_TIMEOUT_MS="30000"

# Switch to non-root user
USER mcpuser
WORKDIR /home/mcpuser

# Health check - verify the server can start
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD python -c "import freecad_mcp; print('ok')" || exit 1

# Default command - run the MCP server in stdio mode
ENTRYPOINT ["freecad-mcp"]