From 070f02e85f9b57267eac00eac67cef68319625dd Mon Sep 17 00:00:00 2001 From: cliffhall Date: Sat, 11 Jul 2026 09:47:25 -0400 Subject: [PATCH] review: set HOME explicitly + note healthcheck assumes --web MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up on the re-review's two optional notes: - Set `ENV HOME=/home/node` so the runtime-state dir (core/storage/store-io.ts resolves it from HOME) is explicit, rather than relying on the "." → WORKDIR fallback that happens to work because Docker doesn't set HOME on USER. - Document that the HEALTHCHECK assumes the default --web mode; suggest `--no-healthcheck` for --cli/--tui runs (no web server to probe). Re-verified: build ok, HOME=/home/node, runs as node (uid 1000), `/` → 200, health → healthy. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01BrihGWcrM9JGRyu41nzZYw --- Dockerfile | 12 ++++++++---- README.md | 2 +- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/Dockerfile b/Dockerfile index c41c415e..0651b7d2 100644 --- a/Dockerfile +++ b/Dockerfile @@ -31,14 +31,18 @@ ENV HOST=0.0.0.0 \ MCP_AUTO_OPEN_ENABLED=false EXPOSE 6274 -# Run as the non-root `node` user the base image ships. Its home (/home/node) is -# where the inspector writes runtime state (the default catalog, OAuth token -# storage), so use it as the working directory. +# Run as the non-root `node` user the base image ships. The inspector resolves +# its runtime-state dir (default catalog, OAuth token storage) from `HOME` +# (core/storage/store-io.ts), so set it explicitly to the node user's writable +# home and work from there. +ENV HOME=/home/node USER node WORKDIR /home/node # Report readiness by probing the served SPA (`/` needs no auth). Uses Node's -# global fetch — no curl/wget in the slim image. +# global fetch — no curl/wget in the slim image. Assumes the default `--web` +# mode; running `--cli`/`--tui` has no web server, so add `--no-healthcheck` to +# `docker run` for those. HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \ CMD node -e "fetch('http://127.0.0.1:'+(process.env.CLIENT_PORT||6274)+'/').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))" diff --git a/README.md b/README.md index 91f3e518..1cc32ed6 100644 --- a/README.md +++ b/README.md @@ -178,7 +178,7 @@ docker build -t mcp-inspector . docker run --rm -p 6274:6274 mcp-inspector ``` -The image defaults to `--web` bound to `0.0.0.0:6274` with browser auto-open disabled; override the args to run another mode (`docker run --rm ghcr.io/modelcontextprotocol/inspector --cli …`). Pass `-e MCP_INSPECTOR_API_TOKEN=…` to set a known token (otherwise one is generated and printed in the logs), or `-e DANGEROUSLY_OMIT_AUTH=true` to disable auth. +The image defaults to `--web` bound to `0.0.0.0:6274` with browser auto-open disabled; override the args to run another mode (`docker run --rm ghcr.io/modelcontextprotocol/inspector --cli …`). Pass `-e MCP_INSPECTOR_API_TOKEN=…` to set a known token (otherwise one is generated and printed in the logs), or `-e DANGEROUSLY_OMIT_AUTH=true` to disable auth. The image runs as the non-root `node` user and has a `HEALTHCHECK` that probes the web UI — it assumes the default `--web` mode, so add `--no-healthcheck` when running `--cli`/`--tui` (which have no web server). ## Contributing — `AGENTS.md` and `CLAUDE.md`