Merge pull request modelcontextprotocol#23 from jkoelker/jk/container

feat(container): add ghcr packaging pipeline

Author: jkoelker

.github/workflows/container.yml

@@ -0,0 +1,52 @@
+name: Container Image
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    tags:
+      - "v*"
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository_owner }}/schwab-mcp
+          tags: |
+            type=ref,event=branch
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+          flavor: |
+            latest=true
+
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Containerfile
+          push: ${{ github.event_name != 'pull_request' }}
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

Containerfile

@@ -0,0 +1,45 @@
+# syntax=docker/dockerfile:1.7
+
+FROM python:3.12-slim AS builder
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
+
+WORKDIR /app
+
+# hadolint ignore=DL3008
+RUN apt-get update \
+    && apt-get install --no-install-recommends -y build-essential \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY pyproject.toml README.md ./
+COPY src ./src
+
+# hadolint ignore=DL3013
+RUN pip install --no-cache-dir --upgrade pip \
+    && pip install --no-cache-dir build \
+    && python -m build --wheel --outdir /dist
+
+FROM python:3.12-slim AS runtime
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
+
+# hadolint ignore=DL3008
+RUN apt-get update \
+    && apt-get install --no-install-recommends -y ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace
+
+COPY --from=builder /dist/ /tmp/dist/
+
+RUN pip install --no-cache-dir /tmp/dist/*.whl \
+    && rm -rf /tmp/dist
+
+LABEL org.opencontainers.image.title="Schwab MCP Server" \
+      org.opencontainers.image.description="Model Context Protocol server for Schwab built on schwab-mcp." \
+      org.opencontainers.image.source="https://github.com/jkoelker/schwab-mcp"
+
+ENTRYPOINT ["schwab-mcp"]
+CMD ["server"]

README.md

@@ -91,6 +91,26 @@ Discord-related flags can also be provided via environment variables:
 - `SCHWAB_MCP_DISCORD_TIMEOUT` (optional, defaults to 600 seconds)
 - `SCHWAB_MCP_DISCORD_APPROVERS` (optional comma-separated list of Discord user IDs)
 
+### Container Image
+
+Published container images are available at `ghcr.io/jkoelker/schwab-mcp`. The image runs `schwab-mcp server` by default and persists token data under `/root/.local/share/schwab-mcp` unless overridden.
+
+```bash
+podman run --rm --interactive \
+  --env SCHWAB_CLIENT_ID \
+  --env SCHWAB_CLIENT_SECRET \
+  --env SCHWAB_CALLBACK_URL \
+  --env SCHWAB_MCP_DISCORD_TOKEN \
+  --env SCHWAB_MCP_DISCORD_CHANNEL_ID \
+  --publish 8182:8182 \
+  --volume ~/.local/share/schwab-mcp:/schwab-mcp \
+  ghcr.io/jkoelker/schwab-mcp:latest \
+    server \
+    --token-path /schwab-mcp/token.yaml
+```
+
+The container entrypoint reads the same environment variables as the CLI, so you can override or add flags by appending them (for example, `... ghcr.io/jkoelker/schwab-mcp:latest --jesus-take-the-wheel`). To explore other entry points, run `docker run ghcr.io/jkoelker/schwab-mcp:latest --help`.
+
 ### Discord approval setup
 
 1. Create or open your application at <https://discord.com/developers/applications>, add a **Bot**, reset the token, and paste it into `SCHWAB_MCP_DISCORD_TOKEN`.