telemetryflow-python-mcp/Dockerfile at main · telemetryflow/telemetryflow-python-mcp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
# =============================================================================
# TelemetryFlow Python MCP Server - Dockerfile
# =============================================================================
#
# TelemetryFlow Python MCP Server - Community Enterprise Observability Platform (CEOP)
# Copyright (c) 2024-2026 Telemetri Data Indonesia. All rights reserved.
#
# Multi-stage build for minimal image size with aggressive CVE patching.
# Uses Debian Trixie (13) base for patched system libraries (zlib 1.3.1,
# sqlite3 3.46+, ncurses 6.5, PAM 1.7) and strips attack-surface packages.
# =============================================================================

# -----------------------------------------------------------------------------
# Stage 1: Builder - Build wheel and install into isolated prefix
# -----------------------------------------------------------------------------
FROM python:3.13-slim-trixie AS builder

ARG VERSION=1.2.0
ARG GIT_COMMIT=unknown
ARG GIT_BRANCH=unknown
ARG BUILD_TIME=unknown

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1

RUN apt-get update && \
    apt-get dist-upgrade -y && \
    apt-get install -y --no-install-recommends \
    git \
    build-essential \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /build

COPY pyproject.toml README.md LICENSE ./
COPY src/ ./src/

RUN pip install --upgrade pip build && \
    python -m build --wheel

# Install into install prefix (no pip in final image)
RUN pip install --prefix=/install --no-cache-dir /build/dist/*.whl

# -----------------------------------------------------------------------------
# Stage 2: Runtime (distroless-like minimal image)
# -----------------------------------------------------------------------------
FROM python:3.13-slim-trixie

LABEL org.opencontainers.image.title="TelemetryFlow Python MCP Server" \
      org.opencontainers.image.description="MCP Server for TelemetryFlow with Claude AI integration and official MCP SDK" \
      org.opencontainers.image.version="1.2.0" \
      org.opencontainers.image.vendor="TelemetryFlow" \
      org.opencontainers.image.authors="Telemetri Data Indonesia <support@telemetryflow.id>" \
      org.opencontainers.image.url="https://telemetryflow.id" \
      org.opencontainers.image.documentation="https://docs.telemetryflow.id" \
      org.opencontainers.image.source="https://github.com/telemetryflow/telemetryflow-python-mcp" \
      org.opencontainers.image.licenses="Apache-2.0" \
      org.opencontainers.image.base.name="python:3.13-slim-trixie" \
      io.telemetryflow.product="TelemetryFlow Python MCP Server" \
      io.telemetryflow.component="telemetryflow-python-mcp" \
      io.telemetryflow.platform="CEOP"

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1 \
    PIP_NO_CACHE_DIR=1 \
    PIP_DISABLE_PIP_VERSION_CHECK=1 \
    TELEMETRYFLOW_ENDPOINT=api.telemetryflow.id:4317 \
    TELEMETRYFLOW_ENVIRONMENT=production

RUN apt-get update && \
    apt-get dist-upgrade -y && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

RUN dpkg --remove --force-remove-essential --force-depends \
       perl-base \
       libperl5.40 \
       perl-modules-5.40 \
       ncurses-bin \
       libncurses6 \
       libncursesw6 \
       ncurses-base \
       libtinfo6 \
       gnupg \
       gnupg-utils \
       gpg \
       gpgv \
       gpg-wks-client \
       gpg-wks-server \
       dirmngr \
       libldap-common \
       libldap-2.5-0 \
       libcurl4 \
       curl \
       binutils \
       binutils-common \
       libbinutils \
       libctf0 \
       libctf-nobfd0 \
    || true

RUN apt-get autoremove -y --purge 2>/dev/null || true \
    && apt-get clean 2>/dev/null || true \
    && rm -rf \
       /var/lib/apt/lists/* \
       /tmp/* \
       /var/tmp/* \
       /usr/share/doc/* \
       /usr/share/man/* \
       /usr/share/info/* \
       /var/log/* \
       /var/cache/* \
       /usr/lib/*/libgcrypt* \
       /usr/lib/*/libsasl2*

RUN groupadd -g 10001 telemetryflow && \
    useradd -u 10001 -g telemetryflow -d /home/telemetryflow -m telemetryflow

RUN mkdir -p /app && chown -R telemetryflow:telemetryflow /app

# Copy pre-installed packages from builder (no pip needed in runtime)
COPY --from=builder /install /usr/local

COPY configs/ /app/configs/

RUN chown -R telemetryflow:telemetryflow /app

USER telemetryflow

WORKDIR /app

HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD python -c "import sys; sys.exit(0)"

ENTRYPOINT ["tfo-mcp"]
CMD ["serve"]