modelcontextprotocol/servers
Watch
1
0
Fork
You've already forked servers
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: Containers - Bind Mounts - Security and Compatibility (Docker / Podman / SELinux) for Fetch, Git, and Time Servers (#2205)

Browse source 
* Update Dockerfile for fetch

Initial patch for podman and SELinux contexts.

* Update Dockerfile for time

podman and SELinux

* Update Dockerfile

* Also include app user / group (securely) such that the build succeeds

* Container app user optional add (#1)

* Update Dockerfile git

* Update Dockerfile fetch

* Update Dockerfile time

* Update Dockerfile

* Update Dockerfile

* Update Dockerfile

---------

Co-authored-by: Ola Hungerford <olahungerford@gmail.com>
This commit is contained in:
Trent Apple 2026-08-30 15:07:02 -05:00 • committed by GitHub
commit ebaccfd623
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 15 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/fetch/Dockerfile
View file

@ -11,9 +11,8 @@ ENV UV_COMPILE_BYTECODE=1
ENV UV_LINK_MODE=copy
# Install the project's dependencies using the lockfile and settings
COPY uv.lock pyproject.toml ./
RUN --mount=type=cache,target=/root/.cache/uv \
--mount=type=bind,source=uv.lock,target=uv.lock \
--mount=type=bind,source=pyproject.toml,target=pyproject.toml \
uv sync --locked --no-install-project --no-dev --no-editable
# Then, add the rest of the project source code and install it
@ -27,6 +26,10 @@ FROM python:3.12-slim-bookworm
WORKDIR /app
COPY --from=uv /root/.local /root/.local
RUN if ! id -u app >/dev/null 2>&1; then \
useradd -rUM -s /usr/sbin/nologin app; \
fi
COPY --from=uv --chown=app:app /app/.venv /app/.venv
# Place executables in the environment at the front of the path

7
src/git/Dockerfile
View file

@ -11,9 +11,8 @@ ENV UV_COMPILE_BYTECODE=1
ENV UV_LINK_MODE=copy
# Install the project's dependencies using the lockfile and settings
COPY uv.lock pyproject.toml ./
RUN --mount=type=cache,target=/root/.cache/uv \
--mount=type=bind,source=uv.lock,target=uv.lock \
--mount=type=bind,source=pyproject.toml,target=pyproject.toml \
uv sync --locked --no-install-project --no-dev --no-editable
# Then, add the rest of the project source code and install it
@ -30,6 +29,10 @@ RUN apt-get update && apt-get install -y git git-lfs && rm -rf /var/lib/apt/list
WORKDIR /app
COPY --from=uv /root/.local /root/.local
RUN if ! id -u app >/dev/null 2>&1; then \
useradd -rUM -s /usr/sbin/nologin app; \
fi
COPY --from=uv --chown=app:app /app/.venv /app/.venv
# Place executables in the environment at the front of the path

7
src/time/Dockerfile
View file

@ -11,9 +11,8 @@ ENV UV_COMPILE_BYTECODE=1
ENV UV_LINK_MODE=copy
# Install the project's dependencies using the lockfile and settings
COPY uv.lock pyproject.toml ./
RUN --mount=type=cache,target=/root/.cache/uv \
--mount=type=bind,source=uv.lock,target=uv.lock \
--mount=type=bind,source=pyproject.toml,target=pyproject.toml \
uv sync --locked --no-install-project --no-dev --no-editable
# Then, add the rest of the project source code and install it
@ -27,6 +26,10 @@ FROM python:3.12-slim-bookworm
WORKDIR /app
COPY --from=uv /root/.local /root/.local
RUN if ! id -u app >/dev/null 2>&1; then \
useradd -rUM -s /usr/sbin/nologin app; \
fi
COPY --from=uv --chown=app:app /app/.venv /app/.venv
# Place executables in the environment at the front of the path