aks-mcp/Dockerfile at main · Azure/aks-mcp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
# Linux Dockerfile for aks-mcp
# Build stage
FROM golang:1.25-alpine AS builder
ARG TARGETOS=linux
ARG TARGETARCH
ARG VERSION
ARG GIT_COMMIT
ARG BUILD_DATE
ARG GIT_TREE_STATE

# Set working directory
WORKDIR /app

# Copy go mod and sum files
COPY go.mod go.sum ./

# Download dependencies
RUN go mod download

# Copy source code
COPY . .

# Build the application for target platform with version injection
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \
    -trimpath \
    -tags withoutebpf \
    -ldflags "-X github.com/Azure/aks-mcp/internal/version.GitVersion=${VERSION} \
              -X github.com/Azure/aks-mcp/internal/version.GitCommit=${GIT_COMMIT} \
              -X github.com/Azure/aks-mcp/internal/version.GitTreeState=${GIT_TREE_STATE} \
              -X github.com/Azure/aks-mcp/internal/version.BuildMetadata=${BUILD_DATE}" \
    -o aks-mcp ./cmd/aks-mcp

# Runtime stage
FROM alpine:3.23
ARG TARGETARCH

# Install required packages for kubectl and helm, plus build tools for Azure CLI
RUN apk add --no-cache curl bash openssl ca-certificates git python3 py3-pip \
    gcc python3-dev musl-dev linux-headers

# Install kubectl
RUN echo $TARGETARCH; curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${TARGETARCH}/kubectl" && \
    chmod +x kubectl && \
    mv kubectl /usr/local/bin/kubectl

# Install kubelogin
RUN KUBELOGIN_VERSION="v0.2.10" && \
    curl -LO "https://github.com/Azure/kubelogin/releases/download/${KUBELOGIN_VERSION}/kubelogin-linux-${TARGETARCH}.zip" && \
    unzip kubelogin-linux-${TARGETARCH}.zip && \
    mv bin/linux_${TARGETARCH}/kubelogin /usr/local/bin/kubelogin && \
    chmod +x /usr/local/bin/kubelogin && \
    rm -r bin/linux_${TARGETARCH} kubelogin-linux-${TARGETARCH}.zip

# Install helm
RUN HELM_ARCH=${TARGETARCH} && \
    curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 && \
    chmod 700 get_helm.sh && \
    VERIFY_CHECKSUM=false ./get_helm.sh && \
    rm get_helm.sh

# Install Azure CLI
RUN pip3 install --break-system-packages --no-cache-dir azure-cli

# Install Cilium CLI
RUN CILIUM_VERSION="v0.18.9" && \
    CILIUM_ARCH=$([ "$TARGETARCH" = "amd64" ] && echo "amd64" || echo "arm64") && \
    curl -L --fail --remote-name-all "https://github.com/cilium/cilium-cli/releases/download/${CILIUM_VERSION}/cilium-linux-${CILIUM_ARCH}.tar.gz{,.sha256sum}" && \
    sha256sum -c cilium-linux-${CILIUM_ARCH}.tar.gz.sha256sum && \
    tar xzvf cilium-linux-${CILIUM_ARCH}.tar.gz && \
    mv cilium /usr/local/bin/cilium && \
    chmod +x /usr/local/bin/cilium && \
    rm cilium-linux-${CILIUM_ARCH}.tar.gz cilium-linux-${CILIUM_ARCH}.tar.gz.sha256sum

# Install Hubble CLI
RUN HUBBLE_VERSION="v1.18.3" && \
    HUBBLE_ARCH=$([ "$TARGETARCH" = "amd64" ] && echo "amd64" || echo "arm64") && \
    curl -L --fail --remote-name-all "https://github.com/cilium/hubble/releases/download/${HUBBLE_VERSION}/hubble-linux-${HUBBLE_ARCH}.tar.gz{,.sha256sum}" && \
    sha256sum -c hubble-linux-${HUBBLE_ARCH}.tar.gz.sha256sum && \
    tar xzvf hubble-linux-${HUBBLE_ARCH}.tar.gz && \
    mv hubble /usr/local/bin/hubble && \
    chmod +x /usr/local/bin/hubble && \
    rm hubble-linux-${HUBBLE_ARCH}.tar.gz hubble-linux-${HUBBLE_ARCH}.tar.gz.sha256sum

# Create the mcp user and group
RUN addgroup -S mcp && \
    adduser -S -G mcp -h /home/mcp mcp && \
    mkdir -p /home/mcp/.kube && \
    chown -R mcp:mcp /home/mcp

# Copy binary from builder
COPY --from=builder /app/aks-mcp /usr/local/bin/aks-mcp

# Set working directory
WORKDIR /home/mcp

# Expose the default port for sse/streamable-http transports
EXPOSE 8000

# Switch to non-root user
USER mcp

# Install Azure CLI extensions as mcp user
RUN az extension add --name costmanagement --allow-preview true && \
    az extension add --name application-insights --allow-preview true

# Set environment variables
ENV HOME=/home/mcp \
    KUBECONFIG=/home/mcp/.kube/config

# Command to run
ENTRYPOINT ["/usr/local/bin/aks-mcp"]
CMD ["--transport", "streamable-http", "--host", "0.0.0.0"]