danhuawang opened a new issue, #12448: URL: https://github.com/apache/gravitino/issues/12448
### What would you like to be improved? The MCP server Docker image currently requires running as root. Setting `runAsUser: 1001` on the container causes an immediate crash: ``` start-mcp-server.sh: line 21: cd: /root/mcp-server: Permission denied error: failed to open file `/root/mcp-server/uv.toml`: Permission denied (os error 13) ``` This is because `/root` is mode `0700` in the `python:3.10` base image, making it inaccessible to any non-root user. Kubernetes deployments increasingly require non-root containers, and OpenShift enforces it by assigning an arbitrary UID and rejecting images that require root. The MCP server is currently the only Gravitino component that cannot run with a non-root security context. ### How should we improve? Adopt the same non-root setup already used by other Gravitino images: - Move the application from `/root/mcp-server` to `/opt/mcp-server` - Use `useradd -u 1000` and `COPY --chmod=775` so arbitrary UIDs (gid 0) can access all application files - Apply `chmod -R 775` to cover `.venv` and the uv cache created by `uv sync` after `COPY` - Pin `UV_CACHE_DIR` inside the application directory to avoid the default `$HOME/.cache/uv` path, which is not writable when `HOME=/` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
