adde9ccf94
Two defaults that each break the Inspector inside a container. #1951 — the web UI never loads in a VS Code dev container. `HOST` defaulted to the NAME `localhost`, and `server.listen(port, host)` resolves a name through `dns.lookup` and binds the SINGLE address it gets back. Since Node 17 the default result order is `verbatim`, so on a glibc Linux host — whose /etc/hosts maps localhost to both 127.0.0.1 and ::1 — that is `::1`. The server bound IPv6 loopback only and refused every IPv4 client, including the dev container port forwarder. It presents as an endless spinner rather than a connection error because the forwarder accepts on the host side before failing to connect inward. Default to the ADDRESS 127.0.0.1 instead; an explicit HOST=localhost is still honored as typed. #2008 — the Apps tab is unreachable in any container. The MCP Apps sandbox listened on an OS-assigned port, so it changed every run and could never be named in a devcontainer `forwardPorts`, a `docker run -p`, or a tunnel. Default it to a fixed 6275, mirroring CLIENT_PORT's fixed 6274, and retry once on an OS-assigned port (loudly) if it is taken — the collision a dynamic default never had. Verified in the reporter's exact image (mcr.microsoft.com/devcontainers/typescript-node:4-24-trixie): both listeners come up on 127.0.0.1 and answer 200 on 6274 and 6275/sandbox. Also EXPOSE 6275 and set MCP_SANDBOX_PORT in the image, and document both defaults in the web README, the migration guide, and the root README's Docker section. Signed-off-by: cliffhall <cliff@futurescale.com>
67 lines
3.4 KiB
Docker
67 lines
3.4 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Build stage — install everything, build all clients, and pack the exact
|
|
# tarball npm would publish. `npm install` runs the root postinstall cascade
|
|
# (per-client installs, since v2 is not a workspace); `npm pack` runs `prepack`
|
|
# (`npm run build`) and emits `modelcontextprotocol-inspector-<version>.tgz`.
|
|
# ---------------------------------------------------------------------------
|
|
FROM node:22-slim AS builder
|
|
WORKDIR /build
|
|
COPY . .
|
|
RUN npm install && npm pack
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Runtime stage — install just the packed tarball (production deps only),
|
|
# yielding a clean global `mcp-inspector` bin: the same artifact a user gets
|
|
# from `npm i -g @modelcontextprotocol/inspector`. The package's postinstall
|
|
# early-exits under node_modules, and the tarball ships only each client's
|
|
# build/ output, so there is nothing to build here.
|
|
# ---------------------------------------------------------------------------
|
|
FROM node:22-slim AS runner
|
|
ENV NODE_ENV=production
|
|
|
|
COPY --from=builder /build/modelcontextprotocol-inspector-*.tgz /tmp/inspector.tgz
|
|
RUN npm install -g /tmp/inspector.tgz && rm /tmp/inspector.tgz
|
|
|
|
# Serve on all interfaces so the UI is reachable from outside the container, and
|
|
# never try to open a browser from inside it. Binding 0.0.0.0 is refused by
|
|
# default (it exposes the process-spawning backend to the network); a container
|
|
# is the sanctioned exception, so opt in explicitly via DANGEROUSLY_BIND_ALL_INTERFACES.
|
|
ENV HOST=0.0.0.0 \
|
|
DANGEROUSLY_BIND_ALL_INTERFACES=true \
|
|
CLIENT_PORT=6274 \
|
|
MCP_SANDBOX_PORT=6275 \
|
|
MCP_AUTO_OPEN_ENABLED=false
|
|
# 6275 is the MCP Apps sandbox, a second listener the browser reaches directly.
|
|
# It is only needed for the Apps tab, so it is EXPOSEd but publishing it is
|
|
# optional — see the Docker section of the root README.
|
|
EXPOSE 6274 6275
|
|
|
|
# Run as the non-root `node` user the base image ships. The inspector resolves
|
|
# its runtime-state dir (default catalog, OAuth token storage) from `HOME`
|
|
# (core/storage/store-io.ts), so set it explicitly to the node user's writable
|
|
# home and work from there.
|
|
ENV HOME=/home/node
|
|
|
|
# Create the runtime-state dir up front, owned by `node`. Docker seeds a named
|
|
# volume's ownership from the image's directory at the mount point — and when
|
|
# that directory does not exist it creates it `root:root`, which the non-root
|
|
# `node` user then cannot write. Without this, `-v inspector-data:/home/node/.mcp-inspector`
|
|
# (the recipe for keeping your saved servers across `docker run --rm`) makes
|
|
# every "add server" fail with `EACCES ... open '/home/node/.mcp-inspector/mcp.json.tmp-*'`.
|
|
RUN mkdir -p /home/node/.mcp-inspector && chown -R node:node /home/node/.mcp-inspector
|
|
|
|
USER node
|
|
WORKDIR /home/node
|
|
|
|
# Report readiness by probing the served SPA (`/` needs no auth). Uses Node's
|
|
# global fetch — no curl/wget in the slim image. Assumes the default `--web`
|
|
# mode; running `--cli`/`--tui` has no web server, so add `--no-healthcheck` to
|
|
# `docker run` for those.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
|
|
CMD node -e "fetch('http://127.0.0.1:'+(process.env.CLIENT_PORT||6274)+'/').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
|
|
|
|
# Default to the web UI; override the args to run --cli / --tui.
|
|
ENTRYPOINT ["mcp-inspector"]
|
|
CMD ["--web"]
|