FROM gcr.io/distroless/static-debian12:nonroot@sha256:aef9602f8710ec12bde19d593fed1f76c708531bb7aba205110f1029786ead7b
ARG SOURCE_SHA
LABEL org.opencontainers.image.source="https://github.com/pingcap-inc/nexuscrm-app-packs" \
      org.opencontainers.image.revision="${SOURCE_SHA}" \
      io.nexuscrm.worker="mcp"
COPY --chown=nonroot:nonroot mcp-worker /usr/local/bin/mcp-worker
USER nonroot:nonroot
ENTRYPOINT ["/usr/local/bin/mcp-worker"]