mcp-ssh-sre/docker-compose.yml at main · ohare93/mcp-ssh-sre · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
version: '3.8'

services:
  mcp-ssh-unraid:
    build:
      context: .
      dockerfile: Dockerfile
    image: mcp-ssh-unraid:latest
    container_name: mcp-ssh-unraid
    restart: unless-stopped

    # Environment variables - configure these or use .env file
    environment:
      # When running ON the Unraid server itself, use localhost
      # When running remotely, use the Unraid server's hostname/IP
      - SSH_HOST=${SSH_HOST:-localhost}
      - SSH_PORT=${SSH_PORT:-22}
      - SSH_USERNAME=${SSH_USERNAME:-mcp-readonly}
      - SSH_PRIVATE_KEY_PATH=/home/mcp/.ssh/id_rsa
      - NODE_ENV=production

    # Volume mounts
    volumes:
      # Mount your SSH private key (read-only)
      # For Unraid: Use the full path to your SSH key
      # Example: /root/.ssh/id_rsa_mcp or /boot/config/ssh/id_rsa_mcp
      # :z flag allows podman to relabel the file for container access
      - ${SSH_KEY_HOST_PATH:-/root/.ssh/id_rsa_mcp}:/home/mcp/.ssh/id_rsa:ro,z

    # Network mode - REQUIRED when running on Unraid server itself
    # This allows the container to access localhost:22 (SSH on the host)
    # Comment out if running remotely and use bridge network instead
    # network_mode: host

    # Standard I/O for MCP protocol
    stdin_open: true
    tty: false

    # Security options
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp

    # Resource limits (optional)
    # deploy:
    #   resources:
    #     limits:
    #       cpus: '1'
    #       memory: 512M
    #     reservations:
    #       cpus: '0.25'
    #       memory: 128M

  # Alternative configuration for remote deployment (not on Unraid itself)
  # Uncomment this service and comment out the one above if deploying remotely
  # mcp-ssh-unraid-remote:
  #   build:
  #     context: .
  #     dockerfile: Dockerfile
  #   image: mcp-ssh-unraid:latest
  #   container_name: mcp-ssh-unraid
  #   restart: unless-stopped
  #   environment:
  #     - SSH_HOST=${SSH_HOST:-unraid.local}
  #     - SSH_PORT=${SSH_PORT:-22}
  #     - SSH_USERNAME=${SSH_USERNAME:-mcp-readonly}
  #     - SSH_PRIVATE_KEY_PATH=/home/mcp/.ssh/id_rsa
  #     - NODE_ENV=production
  #   volumes:
  #     - ${SSH_KEY_HOST_PATH:-~/.ssh/id_rsa_mcp}:/home/mcp/.ssh/id_rsa:ro
  #   # Use bridge network for remote connections (default)
  #   stdin_open: true
  #   tty: false
  #   security_opt:
  #     - no-new-privileges:true
  #   read_only: true
  #   tmpfs:
  #     - /tmp