Both build and runtime stages now use python3.13-alpine3.23 (uv image for the builder, python image for the runtime), with BusyBox addgroup/adduser for the non-root xmcp user. All native dependencies ship musllinux wheels, so no compiler is needed in the builder.
This commit is contained in:
+4
-4
@@ -3,7 +3,7 @@
|
|||||||
# ---- Build stage -------------------------------------------------------------
|
# ---- Build stage -------------------------------------------------------------
|
||||||
# Uses the uv image to resolve and install the pinned dependency set into a
|
# Uses the uv image to resolve and install the pinned dependency set into a
|
||||||
# self-contained virtual environment.
|
# self-contained virtual environment.
|
||||||
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim AS builder
|
FROM ghcr.io/astral-sh/uv:python3.13-alpine3.23 AS builder
|
||||||
|
|
||||||
ENV UV_COMPILE_BYTECODE=1 \
|
ENV UV_COMPILE_BYTECODE=1 \
|
||||||
UV_LINK_MODE=copy \
|
UV_LINK_MODE=copy \
|
||||||
@@ -23,7 +23,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
|
|||||||
uv sync --frozen --no-dev --no-editable
|
uv sync --frozen --no-dev --no-editable
|
||||||
|
|
||||||
# ---- Runtime stage -----------------------------------------------------------
|
# ---- Runtime stage -----------------------------------------------------------
|
||||||
FROM python:3.13-slim-bookworm AS runtime
|
FROM python:3.13-alpine3.23 AS runtime
|
||||||
|
|
||||||
ENV PYTHONDONTWRITEBYTECODE=1 \
|
ENV PYTHONDONTWRITEBYTECODE=1 \
|
||||||
PYTHONUNBUFFERED=1 \
|
PYTHONUNBUFFERED=1 \
|
||||||
@@ -32,8 +32,8 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
|
|||||||
MCP_HOST=0.0.0.0 \
|
MCP_HOST=0.0.0.0 \
|
||||||
MCP_PORT=8000
|
MCP_PORT=8000
|
||||||
|
|
||||||
RUN groupadd --system --gid 1001 xmcp \
|
RUN addgroup -S -g 1001 xmcp \
|
||||||
&& useradd --system --uid 1001 --gid xmcp xmcp
|
&& adduser -S -D -H -u 1001 -G xmcp xmcp
|
||||||
|
|
||||||
WORKDIR /app
|
WORKDIR /app
|
||||||
COPY --from=builder --chown=xmcp:xmcp /app/.venv /app/.venv
|
COPY --from=builder --chown=xmcp:xmcp /app/.venv /app/.venv
|
||||||
|
|||||||
@@ -137,6 +137,6 @@ This publishes `gitea.woggioni.net/woggioni/xmcp:0.1.0` and
|
|||||||
src/xmcp/config.py env var parsing and validation
|
src/xmcp/config.py env var parsing and validation
|
||||||
src/xmcp/spec.py spec loading, base URL resolution, API client
|
src/xmcp/spec.py spec loading, base URL resolution, API client
|
||||||
src/xmcp/server.py FastMCP server construction and entrypoint
|
src/xmcp/server.py FastMCP server construction and entrypoint
|
||||||
Dockerfile multi-stage build (uv builder -> slim runtime, non-root)
|
Dockerfile multi-stage build (uv builder -> alpine runtime, non-root)
|
||||||
.gitea/workflows/build.yaml release pipeline (tag push -> docker build & push)
|
.gitea/workflows/build.yaml release pipeline (tag push -> docker build & push)
|
||||||
```
|
```
|
||||||
|
|||||||
Reference in New Issue
Block a user