# The harness host. Build from the repository root, with the version from git (the build context has no .git):
#   docker build -f packages/harness-host/Dockerfile -t harness-host \
#     --build-arg HARNESS_VERSION="$(uv run python scripts/versions.py python)" .
# Dependencies come from uv.lock, so the image has exactly the versions the tests ran with. The image includes the
# telemetry extra: set OTEL_EXPORTER_OTLP_ENDPOINT to export traces and metrics (contract §13). It also includes
# harness-servers, so HARNESS_MCP_CONFIG can start them over stdio, e.g. the web server with web search (#17):
#   {"servers": [{"name": "web", "command": "python", "args": ["-m", "harness_servers.web"],
#                 "env": {"HARNESS_SEARCH_BACKEND": "searxng", "HARNESS_SEARCH_URL": "http://searxng:8080"}}]}

FROM python:3.12-slim-bookworm AS build
COPY --from=ghcr.io/astral-sh/uv:0.9.10 /uv /usr/local/bin/uv
ARG HARNESS_VERSION
RUN test -n "$HARNESS_VERSION" || (echo "pass --build-arg HARNESS_VERSION (scripts/versions.py python)" && exit 1)
# hatch-vcs reads the version from git; without .git it takes this one.
ENV SETUPTOOLS_SCM_PRETEND_VERSION=${HARNESS_VERSION}
WORKDIR /src
COPY pyproject.toml uv.lock ./
COPY packages ./packages
COPY servers ./servers
COPY samples ./samples
RUN uv export --frozen --no-dev --package knurz-harness-host --extra telemetry --no-emit-workspace --no-hashes -o /out/requirements.txt \
 && uv export --frozen --no-dev --package knurz-harness-servers --no-emit-workspace --no-hashes -o /out/servers.txt \
 && uv build --package knurz-harness --wheel --out-dir /out/wheels \
 && uv build --package knurz-harness-host --wheel --out-dir /out/wheels \
 && uv build --package knurz-harness-servers --wheel --out-dir /out/wheels

FROM python:3.12-slim-bookworm
ARG HARNESS_VERSION
LABEL org.opencontainers.image.title="harness-host" \
      org.opencontainers.image.version="${HARNESS_VERSION}" \
      org.opencontainers.image.source="https://git.knurz.com/developer/harness" \
      org.opencontainers.image.licenses="LicenseRef-Proprietary"
RUN useradd --uid 10001 --create-home --shell /usr/sbin/nologin harness
COPY --from=build /out /tmp/out
RUN pip install --no-cache-dir -r /tmp/out/requirements.txt -r /tmp/out/servers.txt \
 && pip install --no-cache-dir --no-deps /tmp/out/wheels/*.whl \
 && rm -rf /tmp/out
USER 10001
ENV HARNESS_HOST_BIND=0.0.0.0 \
    HARNESS_HOST_PORT=8080 \
    PYTHONUNBUFFERED=1
EXPOSE 8080
CMD ["harness-host"]
