arc-1/Dockerfile at main · ClementRingot/arc-1 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
# =============================================================================
# ARC-1 (ABAP Relay Connector) — MCP Server for SAP ABAP systems
# Multi-stage build: npm ci + tsc → minimal Node.js runtime
#
# Build:  docker build -t arc-1 .
# Run:    docker run -p 8080:8080 -e SAP_URL=... -e SAP_USER=... arc-1
# =============================================================================

# --- Build Stage -------------------------------------------------------------
FROM node:22-alpine AS builder

# better-sqlite3 requires build tools for native addon compilation
RUN apk add --no-cache python3 make g++

WORKDIR /app

# Cache dependencies separately from source
COPY package*.json ./
RUN npm ci

# Copy source and build
COPY tsconfig.json ./
COPY src/ ./src/
RUN npm run build

# Remove dev dependencies for smaller image
RUN npm prune --omit=dev

# --- Runtime Stage -----------------------------------------------------------
FROM node:22-alpine AS runtime

LABEL io.modelcontextprotocol.server.name="io.github.arc-mcp/arc-1"

# tini: proper PID 1 init (handles SIGTERM gracefully)
# ca-certificates: needed for HTTPS connections to SAP systems
#
# apk upgrade first: node:22-alpine can trail the Alpine security repo, so its
# bundled OS packages (libssl3/libcrypto3, busybox, zlib, …) periodically carry
# fixed-upstream HIGH CVEs that the scheduled Trivy gate reports — e.g.
# CVE-2026-45447 (openssl 3.5.6-r0 → 3.5.7-r0). Upgrading the OS layer to the
# latest branch patch level keeps the release image current without waiting for a
# base-image rebuild. CI names this stage so BuildKit can selectively bypass its
# cache and re-run the upgrade while retaining the expensive builder-stage cache.
RUN apk upgrade --no-cache && apk add --no-cache tini ca-certificates

# Drop the bundled npm CLI from the runtime image. We exec `node dist/index.js`
# directly, so npm/npx are never invoked at runtime — but their transitive
# bundle (picomatch, brace-expansion, ip-address, …) recurringly raises HIGH
# CVEs in Trivy. Removing them shrinks
# the image and the CVE surface in one shot.
RUN rm -rf \
  /usr/local/lib/node_modules/npm \
  /usr/local/bin/npm \
  /usr/local/bin/npx

# Run as non-root user
RUN addgroup -S arc1 && adduser -S arc1 -G arc1
WORKDIR /home/arc1

COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package.json ./

USER arc1

# ─── Connection ──────────────────────────────────────────────────────────────
ENV SAP_URL=""
ENV SAP_USER=""
ENV SAP_PASSWORD=""
ENV SAP_CLIENT="100"
ENV SAP_LANGUAGE="EN"
ENV SAP_INSECURE="false"

# ─── Authorization / Safety (safe defaults) ──────────────────────────────────
ENV SAP_ALLOW_WRITES="false"
ENV SAP_ALLOW_DATA_PREVIEW="false"
ENV SAP_ALLOW_FREE_SQL="false"
ENV SAP_BLOCKED_DATA_SOURCES=""
ENV SAP_ALLOWED_PACKAGES="\$TMP"
ENV SAP_ALLOW_TRANSPORT_WRITES="false"
ENV SAP_ALLOW_GIT_WRITES="false"
ENV SAP_DENY_ACTIONS=""

# ─── MCP Transport ──────────────────────────────────────────────────────────
# http-streamable is the default for Docker (not stdio)
ENV SAP_TRANSPORT="http-streamable"
ENV SAP_HTTP_ADDR="0.0.0.0:8080"

# ─── System Type ────────────────────────────────────────────────────────────
# auto = detect from SAP_CLOUD component, btp = BTP ABAP, onprem = on-premise
ENV SAP_SYSTEM_TYPE="auto"

# ─── Feature Flags ──────────────────────────────────────────────────────────
ENV SAP_FEATURE_ABAPGIT="auto"
ENV SAP_FEATURE_RAP="auto"
ENV SAP_FEATURE_AMDP="auto"
ENV SAP_FEATURE_UI5="auto"
ENV SAP_FEATURE_TRANSPORT="auto"
ENV SAP_FEATURE_HANA="auto"

# ─── BTP ABAP Environment ──────────────────────────────────────────────────
# For direct connection via service key (local dev / Docker)
# ENV SAP_BTP_SERVICE_KEY=""
# ENV SAP_BTP_SERVICE_KEY_FILE=""
# ENV SAP_BTP_OAUTH_CALLBACK_PORT="0"

# ─── BTP CF Deployment ─────────────────────────────────────────────────────
# ENV SAP_BTP_DESTINATION=""
# ENV SAP_PP_ENABLED="false"
# ENV SAP_PP_STRICT="false"
# ENV SAP_XSUAA_AUTH="false"

ENV SAP_VERBOSE="false"

EXPOSE 8080

ENTRYPOINT ["/sbin/tini", "--"]
CMD ["node", "dist/index.js"]