Dockerfile.dev

# Dockerfile.dev for VX-RAG development
# Provides more flexibility and debugging capabilities for development
# Security: This is for DEVELOPMENT ONLY - not for production use

# Security: Use specific version for reproducible builds
FROM python:3.13.1-slim

# Set working directory
WORKDIR /app

# Install system dependencies
# Security: Pin versions where possible for reproducibility
# Debian Bookworm packages compatible with Python 3.13.1-slim
# hadolint ignore=DL3008
RUN apt-get update && apt-get install -y --no-install-recommends \
    build-essential \
    git \
    curl \
    vim \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/*

# Copy requirements and install Python dependencies
# Use --no-cache-dir and upgrade pip to reduce disk usage
COPY requirements.txt .
# hadolint ignore=DL3013
RUN pip install --no-cache-dir --upgrade pip && \
    pip install --no-cache-dir -r requirements.txt && \
    rm -rf /root/.cache

# Copy source code
COPY src/ ./src/
COPY config/ ./config/

# Create directories for data and setup user in one layer
RUN mkdir -p /app/data/raw /app/data/processed /app/data/index /app/data/snapshots /app/logs && \
    groupadd -r -g 1000 appuser && \
    useradd -r -u 1000 -g appuser -s /bin/bash appuser && \
    chown -R appuser:appuser /app

# Security: Switch to non-root user
USER appuser

# Expose MCP API ports (default: 25191, HTTP fallback: 8000)
EXPOSE 25191 8000

# Set environment variables
ENV PYTHONPATH=/app
ENV PYTHONUNBUFFERED=1
ENV MCP_TRANSPORT=stdio
ENV MCP_PORT=8000
ENV CONFIG_PATH=./config/settings.yaml

# Default command: start MCP server via CLI
# Uses ENTRYPOINT + CMD for safer argument handling (no shell injection)
ENTRYPOINT ["python", "-m", "src.cli", "serve"]
CMD ["--transport", "stdio", "--host", "0.0.0.0", "--port", "8000", "--config", "./config/settings.yaml"]