38 lines
1.7 KiB
Docker
38 lines
1.7 KiB
Docker
# Debian and not Alpine, deliberately. A multi-toolchain image on musl means pip cannot use the
|
|
# manylinux wheels that almost every Python package ships, so it falls back to building from source
|
|
# and needs a compiler toolchain to do it - a larger image than the one this choice costs, reached
|
|
# by a longer road. Node's own native modules have the same problem.
|
|
FROM node:24-bookworm-slim
|
|
|
|
# The JDK comes from the image that builds it rather than from an apt repository, so the version is
|
|
# the one the project is written for instead of whatever the distribution happens to carry.
|
|
COPY --from=eclipse-temurin:25-jdk /opt/java/openjdk /opt/java/openjdk
|
|
ENV JAVA_HOME=/opt/java/openjdk
|
|
ENV PATH="/opt/java/openjdk/bin:${PATH}"
|
|
|
|
# python3 and pip, and nothing that compiles: a project needing a compiler is a project whose
|
|
# dependencies are not prebuilt, which is a decision for an operator to take knowingly.
|
|
# git is here because a lockfile may name a git dependency; curl because ./mvnw fetches with it.
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends \
|
|
python3 python3-pip python3-venv ca-certificates git curl \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& ln -sf /usr/bin/python3 /usr/local/bin/python \
|
|
&& ln -sf /usr/bin/pip3 /usr/local/bin/pip
|
|
|
|
# No Maven. A Spring project carries ./mvnw, which pins the Maven version the project is built
|
|
# with; installing a second one here would only give an agent a way to use the wrong one.
|
|
|
|
RUN groupadd -g 10001 mcp \
|
|
&& useradd -r -u 10001 -g mcp -M -d /nonexistent mcp \
|
|
&& mkdir -p /tmp/dev-server \
|
|
&& chown -R mcp:mcp /tmp/dev-server
|
|
|
|
WORKDIR /app
|
|
COPY --chown=mcp:mcp package.json ./
|
|
COPY --chown=mcp:mcp src ./src
|
|
|
|
ENV NODE_ENV=production
|
|
USER mcp
|
|
CMD ["node", "src/index.js"]
|