GhostMCP/Dockerfile.base at main · mswilliamrude/GhostMCP · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
FROM python:3.12-slim

# Pin apt to a firewall-reachable Debian mirror. The default deb.debian.org is
# Fastly-fronted and rotates across many IPs; this host's egress allowlist blocks
# some of those Fastly IPs (apt -> "Connection failed [IP: 151.101.x.x]"), while
# cloudfront.debian.net (AWS CloudFront range) is consistently reachable.
RUN set -eux; \
    printf 'deb https://cloudfront.debian.net/debian trixie main\n\
deb https://cloudfront.debian.net/debian trixie-updates main\n\
deb https://cloudfront.debian.net/debian-security trixie-security main\n' \
        > /etc/apt/sources.list; \
    rm -f /etc/apt/sources.list.d/debian.sources

# System deps for Playwright Chromium + SSH
RUN apt-get update && apt-get install -y --no-install-recommends \
    tini \
    curl \
    openssh-server \
    # Playwright Chromium deps (shared libraries needed at runtime)
    libnss3 \
    libnspr4 \
    libatk1.0-0 \
    libatk-bridge2.0-0 \
    libcups2 \
    libdrm2 \
    libxkbcommon0 \
    libxcomposite1 \
    libxdamage1 \
    libxfixes3 \
    libxrandr2 \
    libgbm1 \
    libpango-1.0-0 \
    libcairo2 \
    libasound2 \
    libatspi2.0-0 \
    libxshmfence1 \
    fonts-liberation \
    && rm -rf /var/lib/apt/lists/*

# SSH setup — pubkey only, no password auth
RUN mkdir -p /root/.ssh && chmod 700 /root/.ssh \
    && printf '%s\n' \
        'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIG/jC37ZRA8gjyFqahlhn/WC9IctIJQP+0Cm5/3IilII azureuser@aet-psrdev-centralus-api0' \
        'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJS23M0/uZuDsqSwvSIcpJkplhgfixKas4tP96zVVaAE azureuser@aet-psrdev-centralus-api0' \
        'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKeic3+OjyEUfsT8aEm1+kHNp5vN21B6FSk62lT+sLFo unimind-container-access' \
        > /root/.ssh/authorized_keys \
    && chmod 600 /root/.ssh/authorized_keys \
    && mkdir -p /etc/ssh/sshd_config.d \
    && printf '%s\n' \
        'PasswordAuthentication no' \
        'PermitRootLogin prohibit-password' \
        'PubkeyAuthentication yes' \
        'AuthorizedKeysFile .ssh/authorized_keys' \
        > /etc/ssh/sshd_config.d/ghostmcp.conf \
    && mkdir -p /run/sshd \
    && echo 'export PLAYWRIGHT_BROWSERS_PATH=/app/.cache/ms-playwright' >> /root/.bashrc \
    && echo 'export PYTHONPATH=/app' >> /root/.bashrc \
    && echo 'cd /app' >> /root/.bashrc

# Python deps — these change infrequently
COPY requirements.txt /app/requirements.txt
RUN pip install --no-cache-dir -r /app/requirements.txt

# Install pytest for in-container testing
RUN pip install --no-cache-dir pytest pytest-asyncio

# Ghost user for MCP runtime (non-root)
RUN groupadd -r ghost && useradd -r -g ghost -d /app -s /bin/bash ghost && \
    mkdir -p /app/.cache && chown -R ghost:ghost /app && \
    mkdir -p /tmp/ghostmcp_ratelimit && chown ghost:ghost /tmp/ghostmcp_ratelimit

# Install Playwright Chromium browser binary
# (Until render layer is adopted, this stays in base)
ENV PLAYWRIGHT_BROWSERS_PATH=/app/.cache/ms-playwright
RUN playwright install chromium && \
    playwright install-deps chromium && \
    chown -R ghost:ghost /app/.cache

ENV PYTHONUNBUFFERED=1
ENV PYTHONDONTWRITEBYTECODE=1
ENV PYTHONPATH=/app