# dockroot-mcp — standalone "virtual docker root" MCP server
#
# Drop this container into ANY docker-compose stack and get an MCP server
# exposing read-only docker tools (ps / logs / inspect / stats / networks)
# over the containers on its network. The agent or tool that connects to
# it can SEE and DIAGNOSE the stack without needing host root.
#
# Usage (compose):
#   dockroot:
#     image: jpanasuk/dockroot-mcp:latest
#     container_name: dockroot
#     restart: unless-stopped
#     networks: [your-network]       # the network it can see
#     volumes:
#       - /var/run/docker.sock:/var/run/docker.sock   # read-only docker access
#     # expose to hermes: add to ~/.hermes/config.yaml
#     #   mcp_servers:
#     #     dockroot:
#     #       command: python3
#     #       args: ["/opt/dockroot/tavern_mcp.py"]
#     # or expose via MCPO: add to mcpo config.json mcpServers:
#     #   "dockroot": { "command": "python3", "args": ["/opt/dockroot/tavern_mcp.py"] }
#
# Security: the MCP server ONLY exposes read-only commands (ps/logs/
# inspect/stats/network). The docker socket gives it visibility, not
# control. Do NOT mount the socket if you don't want that visibility.

FROM python:3.12-slim

# docker CLI (read-only tooling needs it) — install the official static
# binary; Debian's docker.io package doesn't reliably install the CLI in
# slim images.
RUN apt-get update && apt-get install -y --no-install-recommends \
    curl ca-certificates \
    && rm -rf /var/lib/apt/lists/* \
    && curl -fsSL -o /tmp/docker.tgz \
       https://download.docker.com/linux/static/stable/x86_64/docker-27.5.1.tgz \
    && tar -xzf /tmp/docker.tgz -C /tmp \
    && install -m 755 /tmp/docker/docker /usr/local/bin/docker \
    && rm -rf /tmp/docker /tmp/docker.tgz \
    && docker --version

# MCP SDK so hermes can connect to this server as a client
RUN pip3 install --no-cache-dir mcp

COPY tavern_mcp.py /opt/dockroot/tavern_mcp.py
COPY discover.py /opt/dockroot/discover.py
COPY recipes.py /opt/dockroot/recipes.py

WORKDIR /opt/dockroot

# Default: run the MCP server on stdio (hermes/mcpo connect via stdio).
# Override the command to run anything else (e.g. bash for debugging).
ENTRYPOINT ["python3", "/opt/dockroot/tavern_mcp.py"]