Latte
b1bc726a95
The DCR client registry created its storage directory eagerly in __init__,
and DCR_STORAGE_PATH defaulted to /var/lib/aegis-mcp — a path that is neither
created in the image nor mounted as a writable volume. Under the hardened
read-only docker-compose, every /oauth/authorize, /oauth/token, and /register
call hit `mkdir('/var/lib/aegis-mcp')` on a read-only filesystem, raising an
unhandled OSError and returning a bare "Internal Server Error" during login.
- oauth_flow.py: defer the storage-dir mkdir from __init__ to _persist (the
only write path). authorize/token only read the registry, so they no longer
require a writable filesystem and stop 500-ing.
- docker/Dockerfile: create and chown /var/lib/aegis-mcp.
- docker-compose.yml + docker/docker-compose.yml: add a persistent
aegis-mcp-data volume mounted at /var/lib/aegis-mcp so DCR registrations
survive restarts.
- .env.example: document DCR_STORAGE_PATH and set PUBLIC_BASE_URL to the real
MCP host.
- README.md: spell out exact values (Gitea host, MCP host, callback URL, MCP
URL) and add a "required writable volumes" section explaining the cause of
the login 500.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
52 lines
1.4 KiB
Docker
52 lines
1.4 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# Build stage
|
|
FROM python:3.12-slim AS builder
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1
|
|
ENV PYTHONUNBUFFERED=1
|
|
ENV PIP_DISABLE_PIP_VERSION_CHECK=1
|
|
|
|
WORKDIR /app
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends gcc \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY requirements.txt ./
|
|
RUN pip install --no-cache-dir --user -r requirements.txt
|
|
|
|
# Runtime stage
|
|
FROM python:3.12-slim
|
|
|
|
ENV PYTHONDONTWRITEBYTECODE=1
|
|
ENV PYTHONUNBUFFERED=1
|
|
ENV PIP_DISABLE_PIP_VERSION_CHECK=1
|
|
ENV NODE_ENV=production
|
|
ENV ENVIRONMENT=production
|
|
ENV PATH=/home/aegis/.local/bin:$PATH
|
|
ENV PYTHONPATH=/app/src:$PYTHONPATH
|
|
|
|
WORKDIR /app
|
|
|
|
# Non-root runtime user
|
|
RUN useradd -m -u 1000 -s /usr/sbin/nologin aegis
|
|
|
|
COPY --from=builder --chown=aegis:aegis /root/.local /home/aegis/.local
|
|
COPY --chown=aegis:aegis src/ ./src/
|
|
COPY --chown=aegis:aegis scripts/ ./scripts/
|
|
|
|
# /var/log/aegis-mcp -> audit log (mount a writable volume)
|
|
# /var/lib/aegis-mcp -> dynamic client registration store (mount a writable, persistent volume)
|
|
RUN mkdir -p /var/log/aegis-mcp /var/lib/aegis-mcp /tmp/aegis-mcp \
|
|
&& chown -R aegis:aegis /var/log/aegis-mcp /var/lib/aegis-mcp /tmp/aegis-mcp
|
|
|
|
USER aegis
|
|
|
|
EXPOSE 8080
|
|
|
|
HEALTHCHECK --interval=30s --timeout=10s --start-period=10s --retries=3 \
|
|
CMD python -c "import httpx; httpx.get('http://127.0.0.1:8080/health', timeout=5)" || exit 1
|
|
|
|
CMD ["python", "-m", "aegis_gitea_mcp.server"]
|