feat: harden gateway with policy engine, secure tools, and governance docs

docker/Dockerfile

@@ -1,53 +1,45 @@
-# Multi-stage build for AegisGitea MCP Server
-FROM python:3.11-slim as builder
+# syntax=docker/dockerfile:1
+
+# Build stage
+FROM python:3.12-slim AS builder
+
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV PYTHONUNBUFFERED=1
 
-# Set working directory
 WORKDIR /app
 
-# Install build dependencies
-RUN apt-get update && \
-    apt-get install -y --no-install-recommends \
-    gcc \
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends gcc \
     && rm -rf /var/lib/apt/lists/*
 
-# Copy requirements
-COPY requirements.txt .
-
-# Install Python dependencies
+COPY requirements.txt ./
 RUN pip install --no-cache-dir --user -r requirements.txt
 
-# Final stage
-FROM python:3.11-slim
+# Runtime stage
+FROM python:3.12-slim
 
-# Set working directory
-WORKDIR /app
-
-# Create non-root user for security
-RUN useradd -m -u 1000 -s /bin/bash aegis
-
-# Copy Python dependencies from builder to aegis user's home
-COPY --from=builder --chown=aegis:aegis /root/.local /home/aegis/.local
-
-# Copy application code
-COPY --chown=aegis:aegis src/ ./src/
-
-# Create directory for audit logs
-RUN mkdir -p /var/log/aegis-mcp && \
-    chown -R aegis:aegis /var/log/aegis-mcp
-
-# Switch to non-root user
-USER aegis
-
-# Add user's local bin to PATH
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV PYTHONUNBUFFERED=1
 ENV PATH=/home/aegis/.local/bin:$PATH
 ENV PYTHONPATH=/app/src:$PYTHONPATH
 
-# Expose MCP server port
+WORKDIR /app
+
+# Non-root runtime user
+RUN useradd -m -u 1000 -s /usr/sbin/nologin aegis
+
+COPY --from=builder --chown=aegis:aegis /root/.local /home/aegis/.local
+COPY --chown=aegis:aegis src/ ./src/
+COPY --chown=aegis:aegis scripts/ ./scripts/
+
+RUN mkdir -p /var/log/aegis-mcp /tmp/aegis-mcp \
+    && chown -R aegis:aegis /var/log/aegis-mcp /tmp/aegis-mcp
+
+USER aegis
+
 EXPOSE 8080
 
-# Health check
-HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
-    CMD python -c "import httpx; httpx.get('http://localhost:8080/health')" || exit 1
+HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
+  CMD python -c "import httpx; httpx.get('http://127.0.0.1:8080/health', timeout=5)" || exit 1
 
-# Run server
 CMD ["python", "-m", "aegis_gitea_mcp.server"]