Ryan Malloy
ebbf2c297c
- Update Dockerfile to default to streamable-http transport - Add docker-compose.oauth-standalone.yml for existing OIDC providers - Add .env.oauth.example template with all required settings - Update README_DOCKER.md with OAuth deployment instructions OAuth mode requires streamable-http transport (not stdio) since authentication happens via browser redirect flow.
70 lines
2.0 KiB
Docker
70 lines
2.0 KiB
Docker
# mcvsphere - Modern Python with uv
|
|
# Multi-stage build for optimal image size
|
|
|
|
# Build stage
|
|
FROM ghcr.io/astral-sh/uv:python3.11-bookworm-slim AS builder
|
|
|
|
WORKDIR /app
|
|
|
|
# Enable bytecode compilation for production
|
|
ENV UV_COMPILE_BYTECODE=1
|
|
ENV UV_LINK_MODE=copy
|
|
|
|
# Install dependencies first (cached layer)
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
--mount=type=bind,source=pyproject.toml,target=pyproject.toml \
|
|
--mount=type=bind,source=uv.lock,target=uv.lock \
|
|
uv sync --frozen --no-install-project --no-dev
|
|
|
|
# Install project
|
|
COPY pyproject.toml uv.lock README.md ./
|
|
COPY src ./src
|
|
RUN --mount=type=cache,target=/root/.cache/uv \
|
|
uv sync --frozen --no-dev --no-editable
|
|
|
|
# Production stage
|
|
FROM python:3.11-slim-bookworm AS production
|
|
|
|
# Create non-root user
|
|
RUN groupadd -r mcpuser && useradd -r -g mcpuser mcpuser
|
|
|
|
WORKDIR /app
|
|
|
|
# Install runtime dependencies only
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& apt-get clean
|
|
|
|
# Copy virtual environment from builder
|
|
COPY --from=builder /app/.venv /app/.venv
|
|
|
|
# Create directories
|
|
RUN mkdir -p /app/logs /app/config \
|
|
&& chown -R mcpuser:mcpuser /app
|
|
|
|
# Environment configuration
|
|
ENV PATH="/app/.venv/bin:$PATH"
|
|
ENV PYTHONUNBUFFERED=1
|
|
ENV PYTHONDONTWRITEBYTECODE=1
|
|
|
|
# Default transport - override with MCP_TRANSPORT env var
|
|
# stdio: Direct CLI usage (default for local)
|
|
# sse: Server-Sent Events (legacy HTTP)
|
|
# streamable-http: HTTP with OAuth support (required for multi-user)
|
|
ENV MCP_TRANSPORT=streamable-http
|
|
ENV MCP_HOST=0.0.0.0
|
|
ENV MCP_PORT=8080
|
|
|
|
# Switch to non-root user
|
|
USER mcpuser
|
|
|
|
EXPOSE 8080
|
|
|
|
# Health check - works with both SSE and streamable-http
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
|
|
CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/.well-known/oauth-authorization-server')" || exit 1
|
|
|
|
# Run the MCP server - transport configured via environment
|
|
ENTRYPOINT ["mcvsphere"]
|