live-memory/Dockerfile at main · Cloud-Temple/live-memory · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
# =============================================================================
# Dockerfile — Live Memory MCP Server (multi-stage, rootless)
# =============================================================================
# Two-stage build:
#   1. Builder — installs dependencies via uv (frozen lockfile)
#   2. Runtime — copies only the venv + source code (no build tools)
#
# Usage :
#   docker compose build
#   docker compose up -d
# =============================================================================

ARG PYTHON_VER=3.11

# ─────────────────────────────────────────────────────────────
# Stage 1: Builder — install dependencies via uv
# ─────────────────────────────────────────────────────────────
FROM ghcr.io/astral-sh/uv:0.7-python${PYTHON_VER}-bookworm-slim AS builder

WORKDIR /app

ENV UV_PROJECT_ENVIRONMENT="/opt/venv"

# 1) Install deps only (cached layer — only invalidated when lockfile changes)
COPY pyproject.toml uv.lock ./
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --no-dev --no-install-project --no-install-workspace

# 2) Install the project itself
COPY VERSION .
COPY src/ src/
RUN --mount=type=cache,target=/root/.cache/uv \
    uv sync --frozen --no-dev

# ─────────────────────────────────────────────────────────────
# Stage 2: Runtime — lean production image
# ─────────────────────────────────────────────────────────────
FROM python:${PYTHON_VER}-slim

WORKDIR /app

# Créer l'utilisateur non-root AVANT tout COPY
RUN useradd -r -u 10001 -s /bin/false mcp

# Copy virtual environment from builder (no pip/setuptools in runtime)
COPY --from=builder --chown=mcp:mcp /opt/venv /opt/venv

# Code source — copié directement avec les bons droits
COPY --chown=mcp:mcp src/ src/
COPY --chown=mcp:mcp scripts/ scripts/
COPY --chown=mcp:mcp RULES/ RULES/
COPY --chown=mcp:mcp VERSION .

ENV PATH="/opt/venv/bin:$PATH" \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

# Basculer sur l'utilisateur non-root (rootless)
USER mcp

EXPOSE 8002

# Healthcheck : vérifier que le serveur répond sur /health
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8002/health', timeout=2)" || exit 1

# Point d'entrée : le serveur MCP
CMD ["python", "-m", "live_mem"]