konflux.Dockerfile

# Multi-stage Dockerfile for ACS MCP Server build on Konflux

# Stage 1: Builder - Build the Go binary
FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_golang_1.25@sha256:c5d1bbc9c6ba9403017a30c2c71e9e28c9f43ffed2e60573a6de20e8ac753689 AS builder

# Build arguments for application version and branding
ARG VERSION=dev
ARG SERVER_NAME="acs-mcp-server"
ARG PRODUCT_DISPLAY_NAME="Red Hat Advanced Cluster Security (ACS)"

# Set working directory
WORKDIR /workspace

# Copy source code
COPY . .

# Build the binary with optimizations
# Output to "/tmp" directory, because user can not copy built binary to "/workspace"
# Go build uses "venodr" mode and that fails, that's why explicit "-mod=mod" is set.
RUN RACE=0 GOOS=$(go env GOOS) GOARCH=$(go env GOARCH) \
    go build \
    -mod=mod \
    -ldflags="-w -s \
      -X 'github.com/stackrox/stackrox-mcp/internal/config.version=${VERSION}' \
      -X 'github.com/stackrox/stackrox-mcp/internal/config.serverName=${SERVER_NAME}' \
      -X 'github.com/stackrox/stackrox-mcp/internal/config.productDisplayName=${PRODUCT_DISPLAY_NAME}'" \
    -trimpath \
    -o /tmp/stackrox-mcp \
    ./cmd/stackrox-mcp


# Stage 2: Runtime base - used to preserve rpmdb when installing packages
FROM registry.access.redhat.com/ubi9/ubi-micro:latest@sha256:7e7f79ab747bf2b452e3043dd89f388e92be4c7fdcc8b815b58adf6c99c39c95 AS ubi-micro-base


# Stage 3: Package installer - installs ca-certificates and openssl into /ubi-micro-base-root/
FROM registry.access.redhat.com/ubi9/ubi:latest@sha256:bcbf1fe577df63bd975ea19ebae604b5f072e1833b2bde417a0ffd4afd938b96 AS package_installer

# Copy ubi-micro base to /ubi-micro-base-root/ to preserve its rpmdb
COPY --from=ubi-micro-base / /ubi-micro-base-root/

# Install packages directly to /ubi-micro-base-root/ using --installroot
# Note: --setopt=reposdir=/etc/yum.repos.d instructs dnf to use repo configurations pointing to RPMs
# prefetched by Hermeto/Cachi2, instead of installroot's default UBI repos.
# hadolint ignore=DL3041 # We are installing ca-certificates and openssl only to include trusted certs.
RUN dnf install -y \
    --installroot=/ubi-micro-base-root/ \
    --releasever=9 \
    --setopt=install_weak_deps=False \
    --setopt=reposdir=/etc/yum.repos.d \
    --nodocs \
    ca-certificates \
    openssl && \
    dnf clean all --installroot=/ubi-micro-base-root/ && \
    rm -rf /ubi-micro-base-root/var/cache/*


# Stage 4: Runtime - Minimal runtime image
FROM ubi-micro-base

# Build arguments for labels
ARG VERSION=dev

# Define labels
LABEL \
    com.redhat.component="agentic-cluster-security-suite-acs-mcp-server-container" \
    com.redhat.license_terms="https://www.redhat.com/agreements" \
    description="The ACS MCP Server" \
    io.k8s.description="The ACS MCP Server" \
    io.k8s.display-name="acs-mcp-server" \
    io.openshift.tags="acs-mcp-server" \
    maintainer="Red Hat, Inc." \
    name="agentic-cluster-security-suite-tech-preview/acs-mcp-server-rhel9" \
    source-location="https://github.com/stackrox/stackrox-mcp" \
    summary="The ACS MCP Server" \
    version="${VERSION}" \
    release="1"

# Set default environment variables
ENV LOG_LEVEL=INFO

# Set working directory
WORKDIR /app

COPY --from=package_installer /ubi-micro-base-root/ /

# Copy binary from builder
COPY --from=builder /tmp/stackrox-mcp /app/stackrox-mcp

# Set ownership for OpenShift arbitrary UID support
# Files owned by 4000, group 0 (root), with group permissions matching user
RUN chown -R 4000:0 /app && \
    chmod -R g=u /app

# Switch to non-root user (can be overridden by OpenShift SCC)
USER 4000

# Expose port for MCP server
EXPOSE 8080

# Run the application
ENTRYPOINT ["/app/stackrox-mcp"]