Add Docker support with GHCR automated publishing (#3)

davidemerli · web-flow · commit 9e02964bed32 · 2025-10-15T18:01:20.000+02:00
diff --git a/.dockerignore b/.dockerignore
@@ -0,0 +1,78 @@
+# Git and version control
+.git
+.gitignore
+.gitattributes
+
+# Python cache and build artifacts
+__pycache__
+*.py[cod]
+*$py.class
+*.so
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# Virtual environments
+venv/
+ENV/
+env/
+.venv
+
+# IDE and editor files
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+
+# Testing and coverage
+.pytest_cache/
+.coverage
+.coverage.*
+htmlcov/
+.tox/
+.nox/
+coverage.xml
+*.cover
+
+# Documentation
+docs/
+*.md
+!README.md
+
+# CI/CD
+.github/
+.gitlab-ci.yml
+.travis.yml
+
+# Development and testing data
+tests/
+test/
+data/
+*.parquet
+*.csv
+
+# Environment files (should be provided at runtime)
+.env
+.env.*
+
+# Logs
+*.log
+
+# OS files
+Thumbs.db
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
@@ -0,0 +1,93 @@
+name: Build and Publish Docker Image
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - 'v*.*.*'
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GitHub Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            # Set latest tag for main branch
+            type=raw,value=latest,enable={{is_default_branch}}
+            # Tag with version for releases (v1.0.0 -> 1.0.0)
+            type=semver,pattern={{version}}
+            # Tag with major.minor for releases (v1.0.0 -> 1.0)
+            type=semver,pattern={{major}}.{{minor}}
+            # Tag with major for releases (v1.0.0 -> 1)
+            type=semver,pattern={{major}}
+            # Tag with PR number for PRs
+            type=ref,event=pr
+            # Tag with branch name (sanitized)
+            type=ref,event=branch
+            # Tag with short SHA
+            type=sha
+
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Generate artifact attestation
+        if: github.event_name != 'pull_request'
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
+
+      - name: Output image details
+        if: github.event_name != 'pull_request'
+        run: |
+          echo "Image published:"
+          echo "Registry: ${{ env.REGISTRY }}"
+          echo "Repository: ${{ env.IMAGE_NAME }}"
+          echo "Tags:"
+          echo "${{ steps.meta.outputs.tags }}"
+          echo ""
+          echo "Pull with:"
+          echo "docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest"
diff --git a/Dockerfile b/Dockerfile
@@ -0,0 +1,61 @@
+# Multi-stage build for FOCUS MCP Server
+# Stage 1: Build environment with dependencies
+# Use official uv image with Python pre-installed
+FROM ghcr.io/astral-sh/uv:python3.11-bookworm-slim AS builder
+
+# Set working directory
+WORKDIR /app
+
+# Copy dependency files first for better caching
+COPY pyproject.toml uv.lock ./
+
+# Install dependencies in a virtual environment
+# This creates a clean, isolated Python environment
+RUN uv sync --frozen --no-dev
+
+# Stage 2: Runtime environment
+# Use minimal Python image for runtime
+FROM python:3.11-slim-bookworm
+
+# Install runtime dependencies for DuckDB
+# These are required for DuckDB's C++ components
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Set working directory
+WORKDIR /app
+
+# Copy the virtual environment from builder
+COPY --from=builder /app/.venv /app/.venv
+
+# Copy application source code
+COPY *.py ./
+COPY LICENSE ./
+COPY resources/ ./resources/
+
+# Set environment variables
+ENV PATH="/app/.venv/bin:$PATH" \
+    PYTHONUNBUFFERED=1 \
+    FOCUS_DATA_LOCATION="/data" \
+    FOCUS_VERSION="1.0"
+
+# Create data directory for mounting
+RUN mkdir -p /data
+
+# Health check (optional - can be used by orchestrators)
+# This verifies the server can start and respond
+HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
+    CMD python -c "import focus_mcp_server; print('OK')" || exit 1
+
+# Expose stdio for MCP communication
+# MCP servers typically communicate via stdio, not HTTP ports
+# Run as non-root user for security
+RUN useradd -m -u 1000 mcp && \
+    chown -R mcp:mcp /app /data
+USER mcp
+
+# Set the entry point to the MCP server
+# Users can override environment variables at runtime
+ENTRYPOINT ["python", "focus_mcp_server.py"]
diff --git a/README.md b/README.md
@@ -223,6 +223,144 @@ The AWS credential chain automatically finds credentials from:
 
 Note: AWS_PROFILE is a standard AWS environment variable that the credential chain respects.
 
+## Docker Usage
+
+### Using Pre-built Images
+
+The server is available as a Docker image on GitHub Container Registry:
+
+```bash
+# Pull the latest image
+docker pull ghcr.io/glassity/focus-mcp:latest
+
+# Or use a specific version
+docker pull ghcr.io/glassity/focus-mcp:v0.1.1
+```
+
+### Running with Docker
+
+#### Local FOCUS Data
+
+```bash
+# Run with local data mounted
+docker run -i --rm \
+  -v "/path/to/your/focus/data:/data:ro" \
+  -e FOCUS_DATA_LOCATION=/data \
+  -e FOCUS_VERSION=1.0 \
+  ghcr.io/glassity/focus-mcp:latest
+```
+
+#### S3 FOCUS Data
+
+**Using AWS credentials from environment:**
+
+```bash
+docker run -i --rm \
+  -e FOCUS_DATA_LOCATION="s3://your-bucket/focus-exports" \
+  -e AWS_REGION="us-west-2" \
+  -e AWS_ACCESS_KEY_ID="your-access-key" \
+  -e AWS_SECRET_ACCESS_KEY="your-secret-key" \
+  ghcr.io/glassity/focus-mcp:latest
+```
+
+**Using AWS profile (recommended for multiple profiles):**
+
+```bash
+docker run -i --rm \
+  -v "$HOME/.aws:/home/mcp/.aws:ro" \
+  -e FOCUS_DATA_LOCATION="s3://your-bucket/focus-exports" \
+  -e AWS_REGION="us-west-2" \
+  -e AWS_PROFILE="billing-reader" \
+  ghcr.io/glassity/focus-mcp:latest
+```
+
+### Using with Claude Desktop
+
+Configure Claude Desktop to use the Docker image in `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "focus": {
+      "command": "docker",
+      "args": [
+        "run",
+        "-i",
+        "--rm",
+        "-v",
+        "/path/to/your/focus/data:/data:ro",
+        "-e",
+        "FOCUS_DATA_LOCATION=/data",
+        "-e",
+        "FOCUS_VERSION=1.0",
+        "ghcr.io/glassity/focus-mcp:latest"
+      ]
+    }
+  }
+}
+```
+
+**For S3 data with environment variables:**
+
+```json
+{
+  "mcpServers": {
+    "focus": {
+      "command": "docker",
+      "args": [
+        "run",
+        "-i",
+        "--rm",
+        "-e", "FOCUS_DATA_LOCATION=s3://your-bucket/focus-exports",
+        "-e", "AWS_REGION=us-west-2",
+        "-e", "AWS_ACCESS_KEY_ID=your-access-key",
+        "-e", "AWS_SECRET_ACCESS_KEY=your-secret-key",
+        "ghcr.io/glassity/focus-mcp:latest"
+      ]
+    }
+  }
+}
+```
+
+**For S3 data with AWS profile:**
+
+```json
+{
+  "mcpServers": {
+    "focus": {
+      "command": "docker",
+      "args": [
+        "run",
+        "-i",
+        "--rm",
+        "-v", "/Users/YOUR_USERNAME/.aws:/home/mcp/.aws:ro",
+        "-e", "FOCUS_DATA_LOCATION=s3://your-bucket/focus-exports",
+        "-e", "AWS_REGION=us-west-2",
+        "-e", "AWS_PROFILE=billing-reader",
+        "ghcr.io/glassity/focus-mcp:latest"
+      ]
+    }
+  }
+}
+```
+
+### Building Your Own Image
+
+```bash
+# Clone the repository
+git clone https://github.com/glassity/focus-mcp.git
+cd focus-mcp
+
+# Build the image
+docker build -t focus-mcp:custom .
+
+# Run your custom image
+docker run -i --rm \
+  -v "/path/to/your/focus/data:/data:ro" \
+  -e FOCUS_DATA_LOCATION=/data \
+  focus-mcp:custom
+```
+
 ## Development
 
 ```bash
diff --git a/pyproject.toml b/pyproject.toml
@@ -7,6 +7,8 @@ dependencies = [
     "duckdb>=1.3.2",
     "mcp[cli]>=1.13.1",
     "pandas>=2.3.2",
+    "pyyaml>=6.0.0",
+    "packaging>=24.0",
 ]
 
 [project.scripts]
diff --git a/uv.lock b/uv.lock

Original file line number	Diff line number	Diff line change
`@@ -7,6 +7,8 @@ dependencies = [`
`7`	`7`	`"duckdb>=1.3.2",`
`8`	`8`	`"mcp[cli]>=1.13.1",`
`9`	`9`	`"pandas>=2.3.2",`
	`10`	`+ "pyyaml>=6.0.0",`
	`11`	`+ "packaging>=24.0",`
`10`	`12`	`]`
`11`	`13`
`12`	`14`	`[project.scripts]`