This is an automated email from the ASF dual-hosted git repository.
yuqi1129 pushed a commit to branch branch-1.3
in repository https://gitbox.apache.org/repos/asf/gravitino.git
The following commit(s) were added to refs/heads/branch-1.3 by this push:
new c27acf2d94 [Cherry-pick to branch-1.3] [#12448] improvement(docker,
mcp): Allow the MCP server image to run as a non-root user (#12446) (#12459)
c27acf2d94 is described below
commit c27acf2d947ee53009763c5b267308b8b8b67399
Author: github-actions[bot]
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Thu Aug 13 20:48:40 2026 +0800
[Cherry-pick to branch-1.3] [#12448] improvement(docker, mcp): Allow the
MCP server image to run as a non-root user (#12446) (#12459)
**Cherry-pick Information:**
- Original commit: ee2eaf9ba428737cbd7565724d1df356eb4c3111
- Target branch: `branch-1.3`
- Status: ✅ Clean cherry-pick (no conflicts)
Co-authored-by: Mark Hoerth <[email protected]>
Co-authored-by: Mark Hoerth <[email protected]>
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
---
dev/docker/mcp-server/Dockerfile | 14 +++++++++++---
dev/docker/mcp-server/start-mcp-server.sh | 2 +-
2 files changed, 12 insertions(+), 4 deletions(-)
diff --git a/dev/docker/mcp-server/Dockerfile b/dev/docker/mcp-server/Dockerfile
index 5826f1c085..3aab0cef36 100644
--- a/dev/docker/mcp-server/Dockerfile
+++ b/dev/docker/mcp-server/Dockerfile
@@ -20,13 +20,16 @@ FROM python:3.10
LABEL maintainer="[email protected]"
-WORKDIR /root/mcp-server
+WORKDIR /opt/mcp-server
COPY --from=ghcr.io/astral-sh/uv:latest /uv /bin/uv
-COPY packages/mcp-server /root/mcp-server
+COPY --chmod=775 packages/mcp-server /opt/mcp-server
-COPY start-mcp-server.sh /root/mcp-server
+COPY --chmod=775 start-mcp-server.sh /opt/mcp-server
+
+# uv defaults its cache to $HOME/.cache/uv, which a non-root user cannot
create.
+ENV UV_CACHE_DIR=/opt/mcp-server/.cache/uv
RUN uv venv
@@ -34,4 +37,9 @@ RUN uv sync
RUN uv pip install -e .
+RUN chmod -R 775 /opt/mcp-server \
+ && useradd -u 1000 -g 0 -M -s /sbin/nologin gravitino
+
+USER 1000
+
ENTRYPOINT ["/bin/bash", "start-mcp-server.sh"]
diff --git a/dev/docker/mcp-server/start-mcp-server.sh
b/dev/docker/mcp-server/start-mcp-server.sh
index ed492e87b6..6947b34700 100644
--- a/dev/docker/mcp-server/start-mcp-server.sh
+++ b/dev/docker/mcp-server/start-mcp-server.sh
@@ -18,6 +18,6 @@
# under the License.
#
-cd /root/mcp-server
+cd /opt/mcp-server
uv run mcp_server $@
