Hermes
6e969b9b2d
build / build (push) Successful in 5s
- Grafana (GF_SERVER_ENFORCE_DOMAIN=true) 301-redirects API calls to the canonical https:// domain; Go TLS verification of the redirected request needs a CA bundle, which scratch lacks. Copy ca-certificates.crt into the final image. - workflow_dispatch gains a 'suffix' input so the same upstream version can be rebuilt under a new tag (v1.1.0-1) without mutating v1.1.0.
69 lines
3.2 KiB
Docker
69 lines
3.2 KiB
Docker
# grafana-mcp — Grafana's official MCP server (grafana/mcp-grafana) as a
|
|
# streamable-HTTP container for cluster0.
|
|
#
|
|
# Built by Gitea Actions (.gitea/workflows/build.yaml):
|
|
# - on push to main
|
|
# - weekly Mon 06:00 UTC (resolves the newest upstream release, skips if
|
|
# the tag is already published) — lands ~7h BEFORE the cluster0
|
|
# image-update cron (Mon 13:00 UTC) so the Monday pass bumps the
|
|
# deployment tag like any other app.
|
|
# - on manual workflow_dispatch with an explicit version
|
|
#
|
|
# The upstream release is a SINGLE static Go binary, fetched from the pinned
|
|
# GitHub release and verified against the release's own sha256 checksums
|
|
# file. No vendored code. Published as
|
|
# gitea.williammiceli.systems/hermes/grafana-mcp:v<version> (plus :latest).
|
|
#
|
|
# The upstream Grafana credentials (GRAFANA_URL is baked in as a default,
|
|
# GRAFANA_SERVICE_ACCOUNT_TOKEN is deploy-time only) are NEVER baked into
|
|
# this image — the token comes from the server's own Kubernetes secret
|
|
# (Kubernetes_Cluster0, namespace ai-0-1) at deploy time.
|
|
|
|
ARG MCP_GRAFANA_VERSION=v1.1.0
|
|
|
|
FROM docker.io/library/alpine:3.22 AS fetch
|
|
|
|
ARG MCP_GRAFANA_VERSION
|
|
ARG TARGETARCH
|
|
|
|
# curl + tar + coreutils (sha256sum/grep) to fetch and verify the pinned
|
|
# upstream release. ca-certificates for HTTPS to github.com — and the CA
|
|
# bundle is copied into the final scratch image too, because Grafana
|
|
# (GF_SERVER_ENFORCE_DOMAIN=true) redirects API calls to its canonical
|
|
# https:// domain and Go's TLS verification needs the bundle.
|
|
RUN apk add --no-cache curl tar coreutils ca-certificates
|
|
|
|
WORKDIR /tmp
|
|
|
|
# Fetch the release checksums file and the linux/${TARGETARCH} tarball, then
|
|
# verify the tarball's sha256 against the checksums file. Fails the build on
|
|
# any mismatch (checksums.txt entries: "<sha256> mcp-grafana_Linux_<arch>.tar.gz").
|
|
RUN set -eux; \
|
|
SHORT="${MCP_GRAFANA_VERSION#v}"; \
|
|
case "$TARGETARCH" in \
|
|
amd64) ASSET="Linux_x86_64" ;; \
|
|
arm64) ASSET="Linux_arm64" ;; \
|
|
*) echo "unsupported TARGETARCH: $TARGETARCH"; exit 1 ;; \
|
|
esac; \
|
|
curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${SHORT}_checksums.txt" -o checksums.txt; \
|
|
curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${ASSET}.tar.gz" -o "mcp-grafana_${ASSET}.tar.gz"; \
|
|
grep "mcp-grafana_${ASSET}.tar.gz" checksums.txt | sha256sum -c -; \
|
|
tar -xzf "mcp-grafana_${ASSET}.tar.gz" mcp-grafana; \
|
|
chmod +x mcp-grafana
|
|
|
|
# The binary is fully static (no INTERP segment) — scratch is sufficient.
|
|
# The CA bundle is copied in for TLS verification of redirected Grafana
|
|
# requests (Grafana enforces its canonical https:// domain).
|
|
FROM scratch
|
|
|
|
COPY --from=fetch /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
|
|
COPY --from=fetch /tmp/mcp-grafana /mcp-grafana
|
|
|
|
EXPOSE 3000
|
|
|
|
# streamable-http on all interfaces, port 3000 (the service port).
|
|
# --allowed-hosts is supplied by the Deployment args (DNS-rebinding
|
|
# protection: only the in-cluster service hostname is trusted).
|
|
# GRAFANA_URL + GRAFANA_SERVICE_ACCOUNT_TOKEN come from the pod env.
|
|
ENTRYPOINT ["/mcp-grafana", "--transport", "streamable-http", "--address", "0.0.0.0:3000"]
|