Dockerfile.mcp

###############################################################
# Copyright (c) 2025-2026 International Color Consortium.
#                 All rights reserved.
#                 https://color.org
#
# Intent: iccDEV MCP runtime container
#
###############################################################

FROM ubuntu:26.04@sha256:fed6ddb82c61194e1814e93b59cfcb6759e5aa33c4e41bb3782313c2386ed6df AS builder
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
ARG DEBIAN_FRONTEND=noninteractive

# Ubuntu package versions intentionally track security updates from the
# digest-pinned base image repository.
# hadolint ignore=DL3008
RUN apt-get update \
 && apt-get install -y --no-install-recommends \
    build-essential \
    cmake \
    libjpeg-dev \
    libpng-dev \
    libtiff-dev \
    libxml2-dev \
    lsb-release \
    make \
    nlohmann-json3-dev \
    python3 \
    python3-dev \
    python3-pip \
    python3-venv \
    zlib1g-dev \
 && rm -rf /var/lib/apt/lists/*

COPY . /opt/iccdev
WORKDIR /opt/iccdev
RUN sed -i '/find_package(wxWidgets COMPONENTS core base REQUIRED)/,/endif()/ s/^/# /' Build/Cmake/CMakeLists.txt
WORKDIR /opt/iccdev/Build
RUN rm -f CMakeCache.txt \
 && rm -rf CMakeFiles \
 && rm -f Cmake/CMakeCache.txt \
 && rm -rf Cmake/CMakeFiles \
 && cmake -DCMAKE_BUILD_TYPE=Release Cmake \
 && make -j"$(nproc)" \
 && rm -rf /opt/iccdev/.git

RUN python3 -m venv /opt/iccdev-mcp-venv \
 && /opt/iccdev-mcp-venv/bin/python -m pip install --no-cache-dir \
      --upgrade \
      'pip>=25.1.1' \
      'setuptools>=78.1.1' \
      'msgpack>=1.2.1' \
 && ICCDEV_BUILD_DIR=/opt/iccdev/Build \
    /opt/iccdev-mcp-venv/bin/python -m pip install --no-cache-dir \
      /opt/iccdev/python \
      "/opt/iccdev/iccdev-mcp[rest]" \
 && /opt/iccdev-mcp-venv/bin/python -m pip check \
 && rm -rf \
      /opt/iccdev-mcp-venv/bin/pip* \
      /opt/iccdev-mcp-venv/lib/python*/site-packages/pip \
      /opt/iccdev-mcp-venv/lib/python*/site-packages/pip-*.dist-info

RUN echo "=== MCP Python packages ===" \
 && /opt/iccdev-mcp-venv/bin/python -c 'from importlib.metadata import version; print("iccdev", version("iccdev")); print("iccdev-mcp", version("iccdev-mcp"))' \
 && echo "=== MCP CLI tools ===" \
 && find /opt/iccdev/Build/Tools -type f -executable | sort

FROM ubuntu:26.04@sha256:fed6ddb82c61194e1814e93b59cfcb6759e5aa33c4e41bb3782313c2386ed6df
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
ARG DEBIAN_FRONTEND=noninteractive

LABEL org.opencontainers.image.title="iccDEV MCP Runtime" \
      org.opencontainers.image.description="Container with iccdev-mcp, Python bindings, and iccDEV CLI tools" \
      org.opencontainers.image.licenses="BSD-3-Clause" \
      org.opencontainers.image.vendor="International Color Consortium" \
      org.opencontainers.image.source="https://github.com/InternationalColorConsortium/iccDEV"

# Ubuntu package versions intentionally track security updates from the
# digest-pinned base image repository.
# hadolint ignore=DL3008
RUN apt-get update && apt-get install -y --no-install-recommends \
    bash \
    libc6 \
    libgcc-s1 \
    libjpeg8 \
    libpng16-16t64 \
    libstdc++6 \
    libssl3t64 \
    libtiff6 \
    libxml2-16 \
    openssl-provider-legacy \
    python3 \
    zlib1g \
 && min_openssl_version="3.5.5-1ubuntu3.2" \
 && for pkg in libssl3t64 openssl-provider-legacy; do \
      version="$(dpkg-query -W -f='${Version}' "$pkg")"; \
      dpkg --compare-versions "$version" ge "$min_openssl_version" || { \
        echo "Package $pkg version $version is below required $min_openssl_version" >&2; \
        exit 1; \
      }; \
    done \
 && rm -rf /var/lib/apt/lists/*

COPY --from=builder /opt/iccdev /opt/iccdev
COPY --from=builder /opt/iccdev-mcp-venv /opt/iccdev-mcp-venv
COPY iccdev-mcp/docker/docker-entrypoint.sh /usr/local/bin/iccdev-mcp-entrypoint

RUN sed -i 's/\r$//' /usr/local/bin/iccdev-mcp-entrypoint \
 && chmod 0755 /usr/local/bin/iccdev-mcp-entrypoint \
 && groupadd -r iccdev \
 && useradd -r -g iccdev -d /opt/iccdev -s /bin/bash iccdev \
 && chown -R iccdev:iccdev /opt/iccdev /opt/iccdev-mcp-venv

ENV ICCDEV_TOOLS_DIR="/opt/iccdev/Build/Tools"
ENV ICCDEV_TESTING_DIR="/opt/iccdev/Testing"
ENV PATH="/opt/iccdev-mcp-venv/bin:/opt/iccdev/Build/Tools/IccToXml:/opt/iccdev/Build/Tools/IccFromXml:/opt/iccdev/Build/Tools/IccDumpProfile:/opt/iccdev/Build/Tools/IccPawgReport:/opt/iccdev/Build/Tools/IccApplyNamedCmm:/opt/iccdev/Build/Tools/IccRoundTrip:/opt/iccdev/Build/Tools/IccFromCube:/opt/iccdev/Build/Tools/IccApplyProfiles:/opt/iccdev/Build/Tools/IccApplySearch:/opt/iccdev/Build/Tools/IccApplyToLink:/opt/iccdev/Build/Tools/IccJpegDump:/opt/iccdev/Build/Tools/IccPngDump:/opt/iccdev/Build/Tools/IccSpecSepToTiff:/opt/iccdev/Build/Tools/IccTiffDump:/opt/iccdev/Build/Tools/IccV5DspObsToV4Dsp:/opt/iccdev/Build/Tools/IccToJson:/opt/iccdev/Build/Tools/IccFromJson:${PATH}"
ENV LD_LIBRARY_PATH="/opt/iccdev/Build/IccProfLib:/opt/iccdev/Build/IccXML:/opt/iccdev/Build/IccJSON:/opt/iccdev/Build/IccConnect"

USER iccdev
WORKDIR /opt/iccdev
EXPOSE 8080
HEALTHCHECK --interval=5m --timeout=10s --start-period=30s --retries=3 \
    CMD python3 -c "import iccdev; import iccdev_mcp" || exit 1

ENTRYPOINT ["iccdev-mcp-entrypoint"]
CMD ["mcp"]