# Debian and not Alpine, deliberately. A multi-toolchain image on musl means pip cannot use the
# manylinux wheels that almost every Python package ships, so it falls back to building from source
# and needs a compiler toolchain to do it - a larger image than the one this choice costs, reached
# by a longer road. Node's own native modules have the same problem.
FROM node:24-bookworm-slim

# The JDK comes from the image that builds it rather than from an apt repository, so the version is
# the one the project is written for instead of whatever the distribution happens to carry.
COPY --from=eclipse-temurin:25-jdk /opt/java/openjdk /opt/java/openjdk
ENV JAVA_HOME=/opt/java/openjdk
ENV PATH="/opt/java/openjdk/bin:${PATH}"

# python3 and pip, and nothing that compiles: a project needing a compiler is a project whose
# dependencies are not prebuilt, which is a decision for an operator to take knowingly.
# git is here because a lockfile may name a git dependency; curl because ./mvnw fetches with it.
RUN apt-get update \
  && apt-get install -y --no-install-recommends \
       python3 python3-pip python3-venv ca-certificates git curl \
  && rm -rf /var/lib/apt/lists/* \
  && ln -sf /usr/bin/python3 /usr/local/bin/python \
  && ln -sf /usr/bin/pip3 /usr/local/bin/pip

# No Maven. A Spring project carries ./mvnw, which pins the Maven version the project is built
# with; installing a second one here would only give an agent a way to use the wrong one.

RUN groupadd -g 10001 mcp \
  && useradd -r -u 10001 -g mcp -M -d /nonexistent mcp \
  && mkdir -p /tmp/dev-server \
  && chown -R mcp:mcp /tmp/dev-server

WORKDIR /app
COPY --chown=mcp:mcp package.json ./
COPY --chown=mcp:mcp src ./src

ENV NODE_ENV=production
USER mcp
CMD ["node", "src/index.js"]