From 8ee7b07b4be4cffcfc7fbe172d03178b56a7a3c2 Mon Sep 17 00:00:00 2001
From: Walter Oggioni <oggioni.walter@gmail.com>
Date: Mon, 19 Oct 2026 04:26:25 +0000
Subject: [PATCH] docker: base the image on alpine

Both build and runtime stages now use python3.13-alpine3.23 (uv image
for the builder, python image for the runtime), with BusyBox
addgroup/adduser for the non-root xmcp user. All native dependencies
ship musllinux wheels, so no compiler is needed in the builder.
---
 Dockerfile | 8 ++++----
 README.md  | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 3945ece..896d664 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,7 @@
 # ---- Build stage -------------------------------------------------------------
 # Uses the uv image to resolve and install the pinned dependency set into a
 # self-contained virtual environment.
-FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim AS builder
+FROM ghcr.io/astral-sh/uv:python3.13-alpine3.23 AS builder
 
 ENV UV_COMPILE_BYTECODE=1 \
     UV_LINK_MODE=copy \
@@ -23,7 +23,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
     uv sync --frozen --no-dev --no-editable
 
 # ---- Runtime stage -----------------------------------------------------------
-FROM python:3.13-slim-bookworm AS runtime
+FROM python:3.13-alpine3.23 AS runtime
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
@@ -32,8 +32,8 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     MCP_HOST=0.0.0.0 \
     MCP_PORT=8000
 
-RUN groupadd --system --gid 1001 xmcp \
- && useradd --system --uid 1001 --gid xmcp xmcp
+RUN addgroup -S -g 1001 xmcp \
+ && adduser -S -D -H -u 1001 -G xmcp xmcp
 
 WORKDIR /app
 COPY --from=builder --chown=xmcp:xmcp /app/.venv /app/.venv
diff --git a/README.md b/README.md
index 5bd57f9..8faad70 100644
--- a/README.md
+++ b/README.md
@@ -137,6 +137,6 @@ This publishes `gitea.woggioni.net/woggioni/xmcp:0.1.0` and
 src/xmcp/config.py        env var parsing and validation
 src/xmcp/spec.py          spec loading, base URL resolution, API client
 src/xmcp/server.py        FastMCP server construction and entrypoint
-Dockerfile                multi-stage build (uv builder -> slim runtime, non-root)
+Dockerfile                multi-stage build (uv builder -> alpine runtime, non-root)
 .gitea/workflows/build.yaml  release pipeline (tag push -> docker build & push)
 ```