f5xc-api-mcp/Dockerfile at main · robinmordasiewicz/f5xc-api-mcp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
# F5 Distributed Cloud API MCP Server
# Multi-stage build for minimal production image

# Build stage
FROM node:26-alpine AS builder

WORKDIR /app

# Copy package files
COPY package*.json ./

# Install dependencies (ignore scripts to avoid premature build)
# The prepare script runs npm build, but tsconfig.json isn't copied yet
RUN npm ci --ignore-scripts

# Copy source files and scripts
COPY tsconfig.json ./
COPY src/ ./src/
COPY scripts/ ./scripts/

# Download OpenAPI specs from upstream (not stored in git)
# Source: https://github.com/robinmordasiewicz/f5xc-api-enriched/releases
RUN npm run sync-specs

# Build TypeScript (now that all source files are present)
# The prebuild hook runs generate:version which needs scripts/
RUN npm run build

# Prune dev dependencies
RUN npm prune --production

# Production stage
FROM node:26-alpine AS production

WORKDIR /app

# Create non-root user and remove npm (not needed in production, eliminates CVEs)
# Removing npm also removes vulnerable bundled dependencies (tar, diff, glob, etc.)
RUN addgroup -g 1001 -S nodejs && \
    adduser -S mcp -u 1001 -G nodejs && \
    rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx

# Copy built files and production dependencies
COPY --from=builder --chown=mcp:nodejs /app/dist ./dist
COPY --from=builder --chown=mcp:nodejs /app/node_modules ./node_modules
COPY --from=builder --chown=mcp:nodejs /app/package.json ./
COPY --from=builder --chown=mcp:nodejs /app/specs ./specs
COPY --chown=mcp:nodejs manifest.json ./

# Switch to non-root user
USER mcp

# Set environment variables
ENV NODE_ENV=production

# Health check - server responds via STDIO, so just check process
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD pgrep -x node || exit 1

# Entry point
ENTRYPOINT ["node", "dist/index.js"]

# Labels
LABEL org.opencontainers.image.title="F5XC API MCP Server" \
      org.opencontainers.image.description="MCP server for F5 Distributed Cloud API" \
      org.opencontainers.image.source="https://github.com/robinmordasiewicz/f5xc-api-mcp" \
      org.opencontainers.image.licenses="MIT"