# =============================================================================
# PDEGO — Apollo MCP Server
# =============================================================================
# Standalone Apollo MCP Server that fronts the federated graph via the MCP
# contract variant. Deployed as the `qa-apollo-mcp` Fargate service; it talks
# to `qa-graphql-router-mcp`. See README.md and the PDEGO MCP rollout doc.
#
# One image serves every environment; the config is chosen at run time, not baked in.
# Day-to-day workflow goes through the Makefile (docker compose under the hood):
# Build:                make build       (docker compose build)
# Run (QA, default):    make run         (docker compose up)
# Run (local):          make run-local   (docker compose -f docker-compose.local.yaml up)
# Inspect:              make inspect     (MCP Inspector against http://localhost:8080/mcp)
#
# Why rebase: Apollo ships apollo-mcp-server on gcr.io/distroless/cc-debian12, which
# has no shell and no curl. The ECS task def's container health check is
# `CMD-SHELL curl -f http://localhost:8080/health` (terraform-fargate default), so on
# distroless every task fails its health check and ECS reaps it in a loop. We take the
# binary and ship it on the Orchard debian13 parent: it carries curl 8.14.1 (debian12's
# 7.88.1 trips the image scanner), is hardened + apt-upgraded, and its newer glibc runs
# the bookworm-built apollo binary fine via backward compatibility.
# =============================================================================

# Source the prebuilt server binary from Apollo's (distroless) image.
# Pinned: bump deliberately, never float on :latest (avoids untested upstream bumps).
FROM --platform=linux/amd64 ghcr.io/apollographql/apollo-mcp-server:v1.15.0@sha256:972dcecf0e99f6fba34df91ca7327fab0a891f04ea0449d6e3efed1117ea632e AS upstream

# Ship on the Orchard debian13 parent so the container health check (curl + /bin/sh) runs.
FROM --platform=linux/amd64 086679231553.dkr.ecr.us-east-1.amazonaws.com/docker-parent-images:debian13 AS deploy

LABEL org.opencontainers.image.title="Orchard PDEGO MCP Server"
LABEL org.opencontainers.image.description="Standalone Apollo MCP Server over the federated graph (MCP contract variant)"
LABEL org.opencontainers.image.source="https://github.com/theorchard/apollo-mcp"

# The parent runs as a non-root user; become root to install the health-check
# client, then drop back. ca-certificates is required for the HTTPS calls to the
# GraphOS uplink and the qa router (distroless bundled them; the slim base does not).
USER root
RUN apt-get -y update \
    && apt-get -y install --no-install-recommends curl ca-certificates \
    && apt-get -y clean \
    && rm -rf /var/lib/apt/lists/*

# Apollo's prebuilt server binary (only artifact we need from the upstream image).
COPY --from=upstream /usr/local/bin/apollo-mcp-server /usr/local/bin/apollo-mcp-server

# Recreate the runtime contract the upstream (distroless) image set for us.
WORKDIR /data
ENV APOLLO_MCP_TRANSPORT__TYPE=streamable_http \
    APOLLO_MCP_TRANSPORT__ADDRESS=0.0.0.0

# Pre-defined operation tools (used when operations.source = local).
COPY operations/ /data/operations/
# Pre-defined instruction prompts
COPY prompts/ /data/prompts/

# Bundle every environment's config so a single image serves them all. The config
# is selected at run time, not baked in, so the exact same artifact promotes from
# qa to prod. WORKDIR is /data, so these land at /data/config/*.
COPY config/ /data/config/

# Streamable HTTP transport.
EXPOSE 8080

# Back to the parent's non-root user for runtime.
USER worker

# Get the VERSION from build args
ARG VERSION
# Set the build arg for VERSION as an environment variable
ENV VERSION=$VERSION

# ENTRYPOINT is the apollo-mcp-server binary; this is its config arg. Defaults to
# QA; override per environment in the Fargate task definition, e.g.
#   command: ["/data/config/mcp.prod.yaml"]
ENTRYPOINT ["apollo-mcp-server"]
CMD ["/data/config/mcp.qa.yaml"]