FROM python:3.12-slim

WORKDIR /app

COPY pyproject.toml ./
COPY bookstack_mcp ./bookstack_mcp

RUN pip install --no-cache-dir . \
    && useradd --system --create-home --home-dir /home/bookstack-mcp --shell /usr/sbin/nologin bookstack-mcp

# fastmcp writes OAuth client registrations/caches under $HOME; point it at the
# service user's own home instead of the default root-owned locations.
ENV HOME=/home/bookstack-mcp \
    XDG_DATA_HOME=/home/bookstack-mcp/.local \
    XDG_CONFIG_HOME=/home/bookstack-mcp/.config \
    XDG_CACHE_HOME=/home/bookstack-mcp/.cache \
    PYTHONUNBUFFERED=1

USER bookstack-mcp
EXPOSE 8080

CMD ["python", "-m", "bookstack_mcp"]