.

docker/Dockerfile

@@ -0,0 +1,54 @@
+# Multi-stage build for AegisGitea MCP Server
+FROM python:3.11-slim as builder
+
+# Set working directory
+WORKDIR /app
+
+# Install build dependencies
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+    gcc \
+    && rm -rf /var/lib/apt/lists/*
+
+# Copy requirements
+COPY requirements.txt .
+
+# Install Python dependencies
+RUN pip install --no-cache-dir --user -r requirements.txt
+
+# Final stage
+FROM python:3.11-slim
+
+# Set working directory
+WORKDIR /app
+
+# Copy Python dependencies from builder
+COPY --from=builder /root/.local /root/.local
+
+# Copy application code
+COPY src/ ./src/
+
+# Create directory for audit logs
+RUN mkdir -p /var/log/aegis-mcp && \
+    chmod 755 /var/log/aegis-mcp
+
+# Create non-root user for security
+RUN useradd -m -u 1000 -s /bin/bash aegis && \
+    chown -R aegis:aegis /app /var/log/aegis-mcp
+
+# Switch to non-root user
+USER aegis
+
+# Add user's local bin to PATH
+ENV PATH=/root/.local/bin:$PATH
+ENV PYTHONPATH=/app/src:$PYTHONPATH
+
+# Expose MCP server port
+EXPOSE 8080
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
+    CMD python -c "import httpx; httpx.get('http://localhost:8080/health')" || exit 1
+
+# Run server
+CMD ["python", "-m", "aegis_gitea_mcp.server"]

docker/docker-compose.yml

@@ -0,0 +1,68 @@
+version: '3.8'
+
+services:
+  aegis-mcp:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile
+    container_name: aegis-gitea-mcp
+    restart: unless-stopped
+    
+    environment:
+      # Gitea configuration (REQUIRED)
+      GITEA_URL: ${GITEA_URL}
+      GITEA_TOKEN: ${GITEA_TOKEN}
+      
+      # MCP server configuration
+      MCP_HOST: ${MCP_HOST:-0.0.0.0}
+      MCP_PORT: ${MCP_PORT:-8080}
+      
+      # Logging configuration
+      LOG_LEVEL: ${LOG_LEVEL:-INFO}
+      AUDIT_LOG_PATH: ${AUDIT_LOG_PATH:-/var/log/aegis-mcp/audit.log}
+      
+      # Security configuration
+      MAX_FILE_SIZE_BYTES: ${MAX_FILE_SIZE_BYTES:-1048576}
+      REQUEST_TIMEOUT_SECONDS: ${REQUEST_TIMEOUT_SECONDS:-30}
+      RATE_LIMIT_PER_MINUTE: ${RATE_LIMIT_PER_MINUTE:-60}
+    
+    ports:
+      - "${MCP_PORT:-8080}:8080"
+    
+    volumes:
+      # Persist audit logs
+      - aegis-mcp-logs:/var/log/aegis-mcp
+      # Optional: mount config file
+      # - ./.env:/app/.env:ro
+    
+    networks:
+      - aegis-network
+    
+    # Security options
+    security_opt:
+      - no-new-privileges:true
+    
+    # Resource limits
+    deploy:
+      resources:
+        limits:
+          cpus: '1.0'
+          memory: 512M
+        reservations:
+          cpus: '0.25'
+          memory: 128M
+    
+    healthcheck:
+      test: ["CMD", "python", "-c", "import httpx; httpx.get('http://localhost:8080/health')"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 10s
+
+volumes:
+  aegis-mcp-logs:
+    driver: local
+
+networks:
+  aegis-network:
+    driver: bridge