# =============================================================================
# Dakera MCP Server — Two-stage Docker build
# =============================================================================
# Lightweight stdio-based MCP binary. No RocksDB, no embedding models.
#
# Build:
# docker build -t dakera-mcp:latest .
#
# Run (stdio mode for MCP clients):
# docker run -i --rm \
# -e DAKERA_API_URL=http://host.docker.internal:3000 \
# -e DAKERA_API_KEY=your-key \
# dakera-mcp:latest
# =============================================================================
# ---------------------------------------------------------------------------
# Stage 1: Builder
# ---------------------------------------------------------------------------
FROM rust:1.92-bookworm AS builder
RUN apt-get update && apt-get install -y \
libssl-dev \
pkg-config \
ca-certificates \
curl \
&& rm -rf /var/lib/apt/lists/*
# Set SSL cert environment variables for cargo
ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
ENV SSL_CERT_DIR=/etc/ssl/certs
ENV CARGO_HTTP_CAINFO=/etc/ssl/certs/ca-certificates.crt
ENV OPENSSL_NO_VENDOR=1
# Override release profile for faster Docker builds
ENV CARGO_PROFILE_RELEASE_LTO=false
ENV CARGO_PROFILE_RELEASE_OPT_LEVEL=2
ENV CARGO_PROFILE_RELEASE_CODEGEN_UNITS=16
WORKDIR /app
# Copy manifests first for dependency layer caching
COPY Cargo.toml ./
COPY Cargo.lock* ./
# Create stub main so cargo can fetch and compile dependencies
RUN mkdir -p src && echo 'fn main() {}' > src/main.rs
# Compile dependencies (cached until Cargo.toml/lock change)
RUN --mount=type=cache,target=/usr/local/cargo/registry \
--mount=type=cache,target=/usr/local/cargo/git \
--mount=type=cache,target=/app/target \
cargo build --release 2>&1 || true
# ---------------------------------------------------------------------------
# Layer 2: Real source compilation
# ---------------------------------------------------------------------------
# Copy real source
COPY src/ src/
# Touch source files to ensure cargo detects them as newer than stubs
RUN find src -name "*.rs" -exec touch {} +
# Build release binary with real source
RUN --mount=type=cache,target=/usr/local/cargo/registry \
--mount=type=cache,target=/usr/local/cargo/git \
--mount=type=cache,target=/app/target \
cargo build --release --bin dakera-mcp && \
cp /app/target/release/dakera-mcp /usr/local/bin/dakera-mcp
# ---------------------------------------------------------------------------
# Stage 2: Runtime
# ---------------------------------------------------------------------------
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y \
ca-certificates \
libssl3 \
&& rm -rf /var/lib/apt/lists/*
# Non-root user
RUN useradd --create-home --shell /bin/false dakera
USER dakera
COPY --from=builder /usr/local/bin/dakera-mcp /usr/local/bin/dakera-mcp
# stdio-based protocol — no ports to expose
ENTRYPOINT ["dakera-mcp"]