Fix Dockerfile for rootless podman

Remove USER and VOLUME directives (cause layer unpacking failures in
rootless podman). Add ARG VERSION for build-time injection. Follow the
standard mcdoc/mcq Dockerfile pattern.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -6,9 +6,9 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 mcat is a lightweight web application for testing MCIAS login policies. It presents a login form, forwards credentials (with configurable `service_name` and `tags`) to MCIAS, and shows whether the login was accepted or denied by policy. Single binary, no database, no gRPC.
 
-Module path: `git.wntrmute.dev/kyle/mcat`
+Module path: `git.wntrmute.dev/mc/mcat`
 
-MCIAS client library: `git.wntrmute.dev/kyle/mcias/clients/go` (imported as `mcias`), local replace directive in go.mod.
+MCIAS client library: `git.wntrmute.dev/mc/mcias/clients/go` (imported as `mcias`), local replace directive in go.mod.
 
 ## Build Commands
 

Dockerfile

@@ -1,18 +1,24 @@
 FROM golang:1.25-alpine AS builder
 
+ARG VERSION=dev
+
+RUN apk add --no-cache git
+
 WORKDIR /build
 COPY go.mod go.sum ./
 RUN go mod download
+
 COPY . .
-RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.version=$(git describe --tags --always --dirty 2>/dev/null || echo unknown)" -o mcat ./cmd/mcat
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.version=${VERSION}" -o mcat ./cmd/mcat
 
 FROM alpine:3.21
-RUN apk --no-cache add ca-certificates && \
+
-    adduser -D -h /srv/mcat mcat
+RUN apk add --no-cache ca-certificates tzdata
-USER mcat
+
-WORKDIR /srv/mcat
 COPY --from=builder /build/mcat /usr/local/bin/mcat
-VOLUME /srv/mcat
+
+WORKDIR /srv/mcat
 EXPOSE 8443
+
 ENTRYPOINT ["mcat"]
 CMD ["server", "--config", "/srv/mcat/mcat.toml"]

Makefile

@@ -1,6 +1,8 @@
-.PHONY: build test vet lint clean all devserver
+.PHONY: build test vet lint clean docker push all devserver
 
-LDFLAGS := -trimpath -ldflags="-s -w -X main.version=$(shell git describe --tags --always --dirty)"
+MCR     := mcr.svc.mcp.metacircular.net:8443
+VERSION := $(shell git describe --tags --always --dirty)
+LDFLAGS := -trimpath -ldflags="-s -w -X main.version=$(VERSION)"
 
 mcat:
 	go build $(LDFLAGS) -o mcat ./cmd/mcat
@@ -20,6 +22,12 @@ lint:
 clean:
 	rm -f mcat
 
+docker:
+	docker build --build-arg VERSION=$(VERSION) -t $(MCR)/mcat:$(VERSION) -f deploy/Dockerfile .
+
+push: docker
+	docker push $(MCR)/mcat:$(VERSION)
+
 all: vet lint test mcat
 
 devserver: mcat

go.mod

@@ -1,9 +1,9 @@
-module git.wntrmute.dev/kyle/mcat
+module git.wntrmute.dev/mc/mcat
 
 go 1.25.7
 
 require (
-	git.wntrmute.dev/kyle/mcdsl v1.0.0
+	git.wntrmute.dev/mc/mcdsl v1.2.0
 	github.com/go-chi/chi/v5 v5.2.5
 	github.com/spf13/cobra v1.10.2
 )

go.sum

@@ -1,5 +1,5 @@
-git.wntrmute.dev/kyle/mcdsl v1.0.0 h1:YB7dx4gdNYKKcVySpL6UkwHqdCJ9Nl1yS0+eHk0hNtk=
+git.wntrmute.dev/mc/mcdsl v1.2.0 h1:41hep7/PNZJfN0SN/nM+rQpyF1GSZcvNNjyVG81DI7U=
-git.wntrmute.dev/kyle/mcdsl v1.0.0/go.mod h1:wo0tGfUAxci3XnOe4/rFmR0RjUElKdYUazc+Np986sg=
+git.wntrmute.dev/mc/mcdsl v1.2.0/go.mod h1:lXYrAt74ZUix6rx9oVN8d2zH1YJoyp4uxPVKQ+SSxuM=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/go-chi/chi/v5 v5.2.5 h1:Eg4myHZBjyvJmAFjFvWgrqDTXFyOzjj7YIm3L3mu6Ug=
 github.com/go-chi/chi/v5 v5.2.5/go.mod h1:X7Gx4mteadT3eDOMTsXzmI4/rwUpOwBHLpAfupzFJP0=

internal/webserver/server.go

@@ -10,12 +10,12 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
-	"git.wntrmute.dev/kyle/mcdsl/auth"
+	"git.wntrmute.dev/mc/mcdsl/auth"
-	"git.wntrmute.dev/kyle/mcdsl/csrf"
+	"git.wntrmute.dev/mc/mcdsl/csrf"
-	"git.wntrmute.dev/kyle/mcdsl/httpserver"
+	"git.wntrmute.dev/mc/mcdsl/httpserver"
-	"git.wntrmute.dev/kyle/mcdsl/web"
+	"git.wntrmute.dev/mc/mcdsl/web"
 
-	mcatweb "git.wntrmute.dev/kyle/mcat/web"
+	mcatweb "git.wntrmute.dev/mc/mcat/web"
 )
 
 const (