Add Dockerfile for the http transport (#10)

* Add Dockerfile for the http transport

* Use alpine base image

Author: ravikiranvm

.dockerignore

@@ -0,0 +1,33 @@
+# Only what the Dockerfile COPYs should reach the build context. Everything else is
+# either regenerated inside the image (.venv), never shipped (tests, docs), or must not
+# be baked into an image at all (.env).
+
+# Local environments and secrets
+.venv
+.env
+.env.*
+
+# Python artefacts
+__pycache__
+*.py[cod]
+*.egg-info
+build/
+dist/
+.pytest_cache
+.mypy_cache
+.ruff_cache
+
+# Not needed at runtime
+tests/
+docs/
+.github/
+*.md
+env.example
+requirements.txt
+
+# Tooling
+.git
+.gitignore
+.vscode
+.idea
+.DS_Store

.github/workflows/ci.yml

@@ -78,3 +78,29 @@ jobs:
         run: uv sync --extra dev --frozen
       - name: Pytest
         run: uv run pytest -q
+
+  image:
+    # Build-only. Publishing to the registry is a separate workflow, triggered by pushes
+    # to main and by releases; this job exists so a Dockerfile that no longer builds on
+    # either architecture cannot merge, rather than failing at publish time.
+    name: Image (${{ matrix.platform }})
+    runs-on: ${{ matrix.platform == 'amd64' && 'ubuntu-latest' || 'ubuntu-arm64' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [amd64, arm64]
+    steps:
+      - uses: actions/checkout@v7.0.1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4.3.0
+      - name: Build image
+        uses: docker/build-push-action@v7.3.0
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/${{ matrix.platform }}
+          build-args: VERSION=${{ github.sha }}
+          push: false
+          provenance: false
+          cache-from: type=gha,scope=${{ matrix.platform }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.platform }}

Dockerfile

@@ -1,4 +1,73 @@
-# Placeholder. Snyk's PR check only tests files already imported as projects from main, so
-# a Dockerfile has to exist here before the real one can be gated. Replaced by the image in
-# the follow-up PR for OPS-4767, which uses this same base.
-FROM python:3.13-slim-bookworm
+# syntax=docker/dockerfile:1
+#
+# The MCP server as its own container, serving the http transport for external clients.
+#
+# The stdio transport is not what this image is for: the API image vendors this repository
+# and spawns it per chat request. This image runs alongside the API as a separate service,
+# reached by agents at ${OPENOPS_MCP_RESOURCE_URL} and reaching the API at ${OPENOPS_API_URL}.
+#
+# Two stages so the runtime never carries uv, the lockfile, or a package cache. The
+# environment is resolved from uv.lock exactly as CI does (--frozen), so the image cannot
+# quietly drift from what was tested.
+
+ARG PYTHON_VERSION=3.13
+
+# ---- Builder stage: resolve the environment from the lockfile ----
+FROM python:${PYTHON_VERSION}-alpine AS builder
+
+COPY --from=ghcr.io/astral-sh/uv:0.9.0 /uv /usr/local/bin/uv
+
+ENV UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    UV_PYTHON_DOWNLOADS=never
+
+WORKDIR /app
+
+# Only the manifests: the environment layer stays cached across source-only changes.
+COPY pyproject.toml uv.lock ./
+
+# --no-install-project: the server runs from source via main.py, the same way the API
+# image runs it, so the package itself is not installed into the environment.
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --frozen --no-dev --no-install-project
+
+# ---- Final stage: runtime only ----
+FROM python:${PYTHON_VERSION}-alpine
+
+ENV LANG=C.UTF-8 \
+    LC_ALL=C.UTF-8 \
+    PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PATH="/app/.venv/bin:$PATH" \
+    # The container is the http deployment. stdio is the API's business.
+    MCP_TRANSPORT=http \
+    MCP_HTTP_HOST=0.0.0.0 \
+    MCP_HTTP_PORT=3020 \
+    # No outbound call to pypi.org at startup, and no ASCII banner in collected logs.
+    FASTMCP_CHECK_FOR_UPDATES=off \
+    FASTMCP_SHOW_SERVER_BANNER=false
+
+# No shell login, no home directory: the process needs neither.
+RUN addgroup -S -g 10001 openops \
+    && adduser -S -u 10001 -G openops -H -s /sbin/nologin openops
+
+WORKDIR /app
+
+COPY --from=builder --chown=openops:openops /app/.venv ./.venv
+COPY --chown=openops:openops main.py ./
+COPY --chown=openops:openops openops_mcp ./openops_mcp
+
+ARG VERSION=unknown
+ENV OPENOPS_MCP_VERSION=$VERSION
+
+LABEL service=openops-mcp \
+      org.opencontainers.image.title="OpenOps MCP" \
+      org.opencontainers.image.description="MCP server exposing OpenOps API operations as tools" \
+      org.opencontainers.image.source="https://github.com/openops-cloud/openops-mcp" \
+      org.opencontainers.image.version=$VERSION
+
+USER openops
+
+EXPOSE 3020
+
+ENTRYPOINT ["python", "main.py"]

README.md

@@ -172,6 +172,32 @@ as HTTP Basic and the resource URL is this server's advertised identity, so clea
 remote host is refused at startup. `OPENOPS_API_URL` is exempt, because tool calls are
 pod-to-pod inside a cluster.
 
+## Docker
+
+The image serves the http transport as its own service next to the API. stdio isn't what it's
+for: the API image vendors this repository and spawns it per chat request.
+
+```bash
+docker build -t openops-mcp .
+
+docker run --rm -p 3020:3020 \
+  -e OPENOPS_API_URL=http://openops-api:3000 \
+  -e OPENOPS_MCP_PROFILE=agent \
+  -e OPENOPS_MCP_ISSUER=https://example.com/api \
+  -e OPENOPS_MCP_RESOURCE_URL=https://example.com/mcp \
+  -e OPENOPS_MCP_CLIENT_SECRET=<at least 32 characters> \
+  openops-mcp
+```
+
+`MCP_TRANSPORT=http`, `MCP_HTTP_HOST=0.0.0.0` and `MCP_HTTP_PORT=3020` are the image's
+defaults. The environment comes from `uv.lock` with the same `uv sync --frozen --no-dev` CI
+runs; the Dockerfile explains the rest of its choices inline.
+
+To test against an API on your machine, the issuer has to be `localhost`, and inside a
+container that's the container. Run with `--network host` (on Docker Desktop, enable it under
+Resources → Network) and point `OPENOPS_API_URL` and `OPENOPS_MCP_ISSUER` at
+`http://localhost:3000`.
+
 ## Configuration reference
 
 | Variable | Transport | Default | Purpose |