Fix Dockerfile for rootless podman

Remove USER and VOLUME directives (cause layer unpacking failures in
rootless podman). Add ARG VERSION for build-time injection. Follow the
standard mcdoc/mcq Dockerfile pattern.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Dockerfile

@@ -1,18 +1,24 @@
 FROM golang:1.25-alpine AS builder
 
+ARG VERSION=dev
+
+RUN apk add --no-cache git
+
 WORKDIR /build
 COPY go.mod go.sum ./
 RUN go mod download
+
 COPY . .
-RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.version=$(git describe --tags --always --dirty 2>/dev/null || echo unknown)" -o mcat ./cmd/mcat
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.version=${VERSION}" -o mcat ./cmd/mcat
 
 FROM alpine:3.21
-RUN apk --no-cache add ca-certificates && \
+
-    adduser -D -h /srv/mcat mcat
+RUN apk add --no-cache ca-certificates tzdata
-USER mcat
+
-WORKDIR /srv/mcat
 COPY --from=builder /build/mcat /usr/local/bin/mcat
-VOLUME /srv/mcat
+
+WORKDIR /srv/mcat
 EXPOSE 8443
+
 ENTRYPOINT ["mcat"]
 CMD ["server", "--config", "/srv/mcat/mcat.toml"]

Makefile

@@ -1,6 +1,8 @@
-.PHONY: build test vet lint clean all devserver
+.PHONY: build test vet lint clean docker push all devserver
 
-LDFLAGS := -trimpath -ldflags="-s -w -X main.version=$(shell git describe --tags --always --dirty)"
+MCR     := mcr.svc.mcp.metacircular.net:8443
+VERSION := $(shell git describe --tags --always --dirty)
+LDFLAGS := -trimpath -ldflags="-s -w -X main.version=$(VERSION)"
 
 mcat:
 	go build $(LDFLAGS) -o mcat ./cmd/mcat
@@ -20,6 +22,12 @@ lint:
 clean:
 	rm -f mcat
 
+docker:
+	docker build --build-arg VERSION=$(VERSION) -t $(MCR)/mcat:$(VERSION) -f deploy/Dockerfile .
+
+push: docker
+	docker push $(MCR)/mcat:$(VERSION)
+
 all: vet lint test mcat
 
 devserver: mcat