Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 4 additions & 16 deletions docs/toolhive/guides-k8s/run-mcp-k8s.md
Original file line number Diff line number Diff line change
Expand Up @@ -208,9 +208,7 @@ The `podTemplateSpec` field follows the standard Kubernetes
[`PodTemplateSpec`](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-template-v1/#PodTemplateSpec)
format, so you can use any valid pod specification options.

This example sets security contexts and resource limits. It lets the MCP
container to run as root, an unfortunate requirement for the Fetch MCP server
image, while still applying some security restrictions.
This example sets resource limits.

```yaml {13-14} title="my-mcpserver-custom-pod.yaml"
apiVersion: toolhive.stacklok.dev/v1alpha1
Expand All @@ -219,34 +217,24 @@ metadata:
name: fetch
namespace: development # Can be any namespace
spec:
image: docker.io/mcp/fetch
transport: stdio
image: ghcr.io/stackloklabs/gofetch/server
transport: sse
port: 8080
targetPort: 8080
permissionProfile:
type: builtin
name: network
podTemplateSpec:
spec:
containers:
- name: mcp # This name must be "mcp"
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: false # Allows the MCP container to run as root
runAsUser: 0
capabilities:
drop:
- ALL
resources: # These resources apply to the MCP container
limits:
cpu: '500m'
memory: '512Mi'
requests:
cpu: '100m'
memory: '128Mi'
securityContext:
runAsNonRoot: true # The pod itself can run as a non-root user
seccompProfile:
type: RuntimeDefault
resources: # These resources apply to the proxy container
limits:
cpu: '100m'
Expand Down
Loading