f5e095e8f0
Address PR #1648 review: - Bump the GHCR action majors to match current v1 (docker/login-action v4, docker/metadata-action v6, docker/setup-buildx-action v4, actions/attest-build-provenance v4) to avoid Dependabot churn. - Make the image tags explicit (`type=semver` + `flavor: latest=true`) instead of relying on `flavor.latest=auto`, so a release lands both the version tags and `:latest` — the README's bare `ghcr.io/…/inspector` URL won't 404. - Run the container as the non-root `node` user with /home/node as workdir (its writable home is where the inspector stores the catalog / OAuth state). - Add a HEALTHCHECK that probes `/` via Node's global fetch (no curl in slim). - Trim specification/ and docs/ from the build context. (test-servers/ stays — `tsc -b` typechecks the integration tests that import its alias, so excluding it breaks the build.) Re-verified locally: `docker build` succeeds, the container runs as uid 1000 (node), serves `/` (200), and the HEALTHCHECK reports healthy. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BrihGWcrM9JGRyu41nzZYw
47 lines
2.1 KiB
Docker
47 lines
2.1 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Build stage — install everything, build all clients, and pack the exact
|
|
# tarball npm would publish. `npm install` runs the root postinstall cascade
|
|
# (per-client installs, since v2 is not a workspace); `npm pack` runs `prepack`
|
|
# (`npm run build`) and emits `modelcontextprotocol-inspector-<version>.tgz`.
|
|
# ---------------------------------------------------------------------------
|
|
FROM node:22-slim AS builder
|
|
WORKDIR /build
|
|
COPY . .
|
|
RUN npm install && npm pack
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# Runtime stage — install just the packed tarball (production deps only),
|
|
# yielding a clean global `mcp-inspector` bin: the same artifact a user gets
|
|
# from `npm i -g @modelcontextprotocol/inspector`. The package's postinstall
|
|
# early-exits under node_modules, and the tarball ships only each client's
|
|
# build/ output, so there is nothing to build here.
|
|
# ---------------------------------------------------------------------------
|
|
FROM node:22-slim AS runner
|
|
ENV NODE_ENV=production
|
|
|
|
COPY --from=builder /build/modelcontextprotocol-inspector-*.tgz /tmp/inspector.tgz
|
|
RUN npm install -g /tmp/inspector.tgz && rm /tmp/inspector.tgz
|
|
|
|
# Serve on all interfaces so the UI is reachable from outside the container, and
|
|
# never try to open a browser from inside it.
|
|
ENV HOST=0.0.0.0 \
|
|
CLIENT_PORT=6274 \
|
|
MCP_AUTO_OPEN_ENABLED=false
|
|
EXPOSE 6274
|
|
|
|
# Run as the non-root `node` user the base image ships. Its home (/home/node) is
|
|
# where the inspector writes runtime state (the default catalog, OAuth token
|
|
# storage), so use it as the working directory.
|
|
USER node
|
|
WORKDIR /home/node
|
|
|
|
# Report readiness by probing the served SPA (`/` needs no auth). Uses Node's
|
|
# global fetch — no curl/wget in the slim image.
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
|
|
CMD node -e "fetch('http://127.0.0.1:'+(process.env.CLIENT_PORT||6274)+'/').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
|
|
|
|
# Default to the web UI; override the args to run --cli / --tui.
|
|
ENTRYPOINT ["mcp-inspector"]
|
|
CMD ["--web"]
|