Dockerfile

FROM python:3.11-slim

# NOTE: MoMo uses hatch-vcs (dynamic version from git metadata). The build
# context MUST include the .git directory or the version cannot be resolved.
# There is no .dockerignore, so `COPY . /app` below already includes it -- do
# not add .git to .dockerignore/.gitignore for the build context.

# Run as an unprivileged user instead of root.
RUN useradd --create-home --uid 1000 --shell /bin/bash momo

WORKDIR /app

# Copy the source (incl. .git for hatch-vcs) and install the base package only.
# Dev/test extras (.[dev]) are intentionally excluded from the production image.
COPY . /app
RUN pip install --no-cache-dir . \
    && chown -R momo:momo /app

USER momo

ENTRYPOINT ["momo"]
CMD ["version"]