modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix(docker): publish on loopback by default; make a mounted state dir writable

Browse source 
Closes #1964.

- README's Docker recipes dropped v1's `127.0.0.1:` prefix, so
  `-p 6274:6274` published the Inspector on every host interface. The
  container's `HOST=0.0.0.0` governs the container's interfaces, not the
  host's, so `DANGEROUSLY_BIND_ALL_INTERFACES` never covered this. Verified
  against a real container: from a LAN peer, `GET /` served the injected
  `MCP_INSPECTOR_API_TOKEN`, and that token then unlocked `/api/*` with no
  `Origin` header (server.ts:241 allows origin-less requests). Restore the
  prefix on both recipes, on the port-remap examples, and in the web README.

- Adding a server failed inside the container the moment you mounted a
  volume to keep it. Docker seeds a named volume's ownership from the
  image's directory at the mount point, and creates it `root:root` when
  that directory is absent — so the non-root `node` user got
  `EACCES ... open '/home/node/.mcp-inspector/mcp.json.tmp-*'`. Create the
  dir in the image, owned by `node`, and document the volume recipe (plus
  the bind-mount `--user` caveat) — without a volume the catalog lives in
  the writable layer and `--rm` throws it away.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SFXDQBEjvjCEBhmYkmw79a
This commit is contained in:
cliffhall 2026-08-11 09:34:41 -04:00
commit 3173b264f7
1 changed files with 25 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Dockerfile
View file

@ -39,6 +39,15 @@ EXPOSE 6274
# (core/storage/store-io.ts), so set it explicitly to the node user's writable
# home and work from there.
ENV HOME=/home/node
# Create the runtime-state dir up front, owned by `node`. Docker seeds a named
# volume's ownership from the image's directory at the mount point — and when
# that directory does not exist it creates it `root:root`, which the non-root
# `node` user then cannot write. Without this, `-v inspector-data:/home/node/.mcp-inspector`
# (the recipe for keeping your saved servers across `docker run --rm`) makes
# every "add server" fail with `EACCES ... open '/home/node/.mcp-inspector/mcp.json.tmp-*'`.
RUN mkdir -p /home/node/.mcp-inspector && chown -R node:node /home/node/.mcp-inspector
USER node
WORKDIR /home/node