feat: add Dockerfile and container image CI by SzymonIwaniuk · Pull Request #25 · kubeflow/mcp-server

SzymonIwaniuk · 2026-05-17T11:36:35Z

fixes #17

Description

Implements a production-ready container image and CI publish pipeline for in-cluster deployment of the Kubeflow MCP Server.

Dockerfile

Multi-stage build: builder (uv install) -> runtime (python:3.12-slim)
Non-root user kubeflow-mcp (uid 65532) for hardened security
Only the pre-built .venv copied to the final image - no compiler, no uv, no source
Exposes port 8000 with kubeflow-mcp serve --transport http as the default entrypoint
KUBEFLOW_MCP_AUTH_TOKEN and KUBEFLOW_MCP_LOG_FORMAT=json configurable via env

CI Workflow (`.github/workflows/docker-publish.yaml`)

Triggers on v*.*.* release tags and workflow_dispatch
Builds multi-arch image (linux/amd64, linux/arm64) via Docker Buildx + QEMU
Pushes to ghcr.io/kubeflow/mcp-server with semver tags (1.2.3, 1.2, 1, latest)
No manual secrets - authenticates to GHCR using GITHUB_TOKEN
GHA layer cache for fast subsequent builds
Trivy scan for CRITICAL CVEs after push - fails the release if any are found

Documentation

New "Run with Docker" section in README.md with docker run one-liner, full env var reference table, and MCP client config snippet for HTTP transport

Checklist

docker build -t kubeflow-mcp:local . succeeds
Container starts and serves on port 8000
Linting passes (make verify)
Commit messages follow conventional format

cc: @abhijeet-dhumal

Signed-off-by: SzymonIwaniuk <szymon.iwaniuk@joinmoxie.com>

google-oss-prow · 2026-05-17T11:36:41Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign andreyvelich for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

abhijeet-dhumal · 2026-05-18T05:52:33Z

Hey @Krishna-kg732, can you take a look at this PR, this will be part of release workflow you are working on right?
#16

Krishna-kg732 · 2026-05-18T12:36:59Z

+            type=semver,pattern={{major}}
+            type=raw,value=latest
+
+      - name: Build and push


Thank you @SzymonIwaniuk . should we consider injecting the release version into the image (via build args / OCI labels)? Right now versioning is only at the tag level, which can make runtime debugging harder.

Yeah, great idea - agree with that

Krishna-kg732 · 2026-05-18T12:44:23Z

+*.yaml
+*.yml


Suggested change

*.yaml

*.yml

Krishna-kg732 · 2026-05-18T12:44:28Z

+
+FROM python:3.12-slim AS builder
+
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv


Suggested change

COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv

COPY --from=ghcr.io/astral-sh/uv:0.11.14/uv /usr/local/bin/uv

Krishna-kg732 · 2026-05-18T12:51:13Z

+
+USER 65532:65532
+
+ENTRYPOINT ["kubeflow-mcp", "serve", "--transport", "http"]


Suggested change

ENTRYPOINT ["kubeflow-mcp", "serve", "--transport", "http"]

ENTRYPOINT ["sh", "-c", "exec kubeflow-mcp serve --transport ${MCP_TRANSPORT}"]

Krishna-kg732 · 2026-05-18T12:53:11Z

Hey @SzymonIwaniuk , few nits , rest looks good
Thanks!

cc: @abhijeet-dhumal

SzymonIwaniuk · 2026-05-19T07:25:28Z

Hey @Krishna-kg732, appreciate suggestions and feedback, thanks - gonna apply them 🚀

Signed-off-by: SzymonIwaniuk <szymon.iwaniuk@joinmoxie.com>

Copilot

Pull request overview

Adds a production container image build plus an automated GitHub Actions pipeline to publish multi-arch images to GHCR, along with Docker run documentation to support in-cluster HTTP deployments of the Kubeflow MCP Server.

Changes:

Introduces a multi-stage Dockerfile (builder + slim runtime) running as a non-root user.
Adds a GH Actions workflow to build/push multi-arch images on semver tags (and manual dispatch) and run a post-push Trivy scan.
Updates README.md with “Run with Docker” instructions and environment variable reference.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
README.md	Adds Docker usage docs and MCP HTTP client config snippet.
Dockerfile	Defines multi-stage build and hardened runtime image defaults/entrypoint.
.github/workflows/docker-publish.yaml	Adds CI to build/push multi-arch images to GHCR and scan with Trivy.
.dockerignore	Reduces Docker build context by excluding dev/test artifacts and tooling files.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

SzymonIwaniuk · 2026-05-19T07:48:09Z

Applied all suggestions, let me know WDYT @Krishna-kg732

One thing Copilot flagged: KUBEFLOW_MCP_LOG_FORMAT in the Dockerfile has no effect since kubeflow_mcp/core/config.py only reads LOG_FORMAT. I can either fix the Dockerfile to use LOG_FORMAT=jsonor add KUBEFLOW_MCP_LOG_FORMAT support to the config loader with LOG_FORMAT as a fallback which one more suits to you?

Krishna-kg732 · 2026-05-19T08:09:45Z

lgtm,

Let’s keep the config surface simple and align with what the code already expects — I’d go with updating the Dockerfile to use LOG_FORMAT=json. for now .

Signed-off-by: SzymonIwaniuk <szymon.iwaniuk@joinmoxie.com>

SzymonIwaniuk · 2026-05-19T08:31:08Z

Done

abhijeet-dhumal · 2026-05-20T07:43:18Z

+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+FROM python:3.12-slim AS builder


it seems python:3.12-slim is floating tag here. can we pin to a patch version so two builds don't silently pull different base images?

abhijeet-dhumal · 2026-05-20T07:48:46Z

+  push:
+    tags:
+      - "v*.*.*"
+  workflow_dispatch:


Looks like there's no PR build path, so a broken Dockerfile would only surface when a release tag is pushed. Would it make sense to add a pull_request trigger with push: false so we at least validate the build on PRs?

abhijeet-dhumal · 2026-05-20T07:51:18Z

+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |


This will tag a v1.0.0-rc.1 as latest too - is that intentional? We could add an enable condition to only update latest on non-prerelease tags:
type=raw,value=latest,enable=${{ github.ref_type == 'tag' && !contains(github.ref_name, '-') }}

abhijeet-dhumal · 2026-05-20T08:37:09Z

+      - name: Scan image for critical CVEs (Trivy)
+        uses: aquasecurity/trivy-action@0.30.0
+        with:
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}


Minor nit - scanning by tag means there's a small window where another concurrent push could overwrite the tag between the build and the scan. Using the digest directly would be safer, wdyt?

feat: Add Dockerfile, CI publish workflow, and Docker docs

b9601ad

Signed-off-by: SzymonIwaniuk <szymon.iwaniuk@joinmoxie.com>

google-oss-prow Bot requested review from andreyvelich, kramaranya and szaher May 17, 2026 11:36

google-oss-prow Bot added the size/L label May 17, 2026

SzymonIwaniuk changed the title ~~feat: Add Dockerfile, CI publish workflow, and Docker docs~~ feat: add Dockerfile and container image CI May 17, 2026

Krishna-kg732 reviewed May 18, 2026

View reviewed changes

fix: apply review suggestions

cac42cc

Signed-off-by: SzymonIwaniuk <szymon.iwaniuk@joinmoxie.com>

Copilot AI review requested due to automatic review settings May 19, 2026 07:36

Copilot started reviewing on behalf of SzymonIwaniuk May 19, 2026 07:37 View session

Copilot AI reviewed May 19, 2026

View reviewed changes

Comment thread Dockerfile Outdated

Comment thread Dockerfile

Comment thread README.md Outdated

fix: use LOG_FORMAT env var

23ccdfe

Signed-off-by: SzymonIwaniuk <szymon.iwaniuk@joinmoxie.com>

abhijeet-dhumal reviewed May 20, 2026

View reviewed changes


		FROM python:3.12-slim AS builder

		COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv

	COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
	COPY --from=ghcr.io/astral-sh/uv:0.11.14/uv /usr/local/bin/uv


		USER 65532:65532

		ENTRYPOINT ["kubeflow-mcp", "serve", "--transport", "http"]

	ENTRYPOINT ["kubeflow-mcp", "serve", "--transport", "http"]
	ENTRYPOINT ["sh", "-c", "exec kubeflow-mcp serve --transport ${MCP_TRANSPORT}"]

Conversation

SzymonIwaniuk commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Dockerfile

CI Workflow (.github/workflows/docker-publish.yaml)

Documentation

Checklist

Uh oh!

google-oss-prow Bot commented May 17, 2026

Uh oh!

abhijeet-dhumal commented May 18, 2026

Uh oh!

Krishna-kg732 May 18, 2026

Choose a reason for hiding this comment

Uh oh!

SzymonIwaniuk May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Krishna-kg732 May 18, 2026

Choose a reason for hiding this comment

Uh oh!

Krishna-kg732 May 18, 2026

Choose a reason for hiding this comment

Uh oh!

Krishna-kg732 May 18, 2026

Choose a reason for hiding this comment

Uh oh!

Krishna-kg732 commented May 18, 2026

Uh oh!

SzymonIwaniuk commented May 19, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SzymonIwaniuk commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Krishna-kg732 commented May 19, 2026

Uh oh!

SzymonIwaniuk commented May 19, 2026

Uh oh!

abhijeet-dhumal May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

abhijeet-dhumal May 20, 2026

Choose a reason for hiding this comment

Uh oh!

abhijeet-dhumal May 20, 2026

Choose a reason for hiding this comment

Uh oh!

abhijeet-dhumal May 20, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

SzymonIwaniuk commented May 17, 2026 •

edited

Loading

CI Workflow (`.github/workflows/docker-publish.yaml`)

SzymonIwaniuk May 19, 2026 •

edited

Loading

SzymonIwaniuk commented May 19, 2026 •

edited

Loading

abhijeet-dhumal May 20, 2026 •

edited

Loading