# Linux verification rig: the server as built from this checkout, a
# headless Debian Chromium, and pi with pi-mcp-adapter to drive it the way
# a real agent does. Run it through ./verify.sh, which builds this image,
# copies your pi config and .env in at setup, and opens pi.
#
# Nothing secret is baked in: the Apple credentials and pi auth arrive by
# docker cp into the running container and never enter an image layer.
FROM golang:1-bookworm AS build
WORKDIR /src
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -trimpath -buildvcs=false -o /out/icloud-mcp ./cmd/icloud-mcp

FROM node:24-bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends chromium ca-certificates tzdata \
    && rm -rf /var/lib/apt/lists/*
RUN npm install -g --no-fund --no-audit @earendil-works/pi-coding-agent pi-mcp-adapter
COPY --from=build /out/icloud-mcp /usr/local/bin/icloud-mcp

# The MCP entry sources /work/.env (copied in by verify.sh) into the
# server's own process only, like local.sh does on a checkout.
RUN printf '#!/bin/sh\nset -a\n. /work/.env\nset +a\nexec icloud-mcp "$@"\n' > /usr/local/bin/icloud-mcp-env \
    && chmod 755 /usr/local/bin/icloud-mcp-env

# Chromium refuses to sandbox as root, so everything runs as node.
USER node
WORKDIR /work
RUN mkdir -p /home/node/.pi/agent \
    && printf '{"mcpServers":{"icloud":{"command":"icloud-mcp-env","lifecycle":"eager","requestTimeoutMs":330000,"directTools":true}}}\n' > /work/.mcp.json
# Bind the login door on the container's interface; verify.sh publishes
# it on the host's loopback only.
ENV ICLOUD_DOOR_BIND=0.0.0.0
CMD ["sleep", "infinity"]