mirror of
https://github.com/jmagar/unraid-mcp.git
synced 2026-03-01 16:04:24 -08:00
316193c04b
Addresses all critical, high, medium, and low issues from full codebase review. 494 tests pass, ruff clean, ty type-check clean. Security: - Add tool_error_handler context manager (exceptions.py) — standardised error handling, eliminates 11 bare except-reraise patterns - Remove unused exception subclasses (ConfigurationError, UnraidAPIError, SubscriptionError, ValidationError, IdempotentOperationError) - Harden GraphQL subscription query validator with allow-list and forbidden-keyword regex (diagnostics.py) - Add input validation for rclone create_remote config_data: injection, path-traversal, and key-count limits (rclone.py) - Validate notifications importance enum before GraphQL request (notifications.py) - Sanitise HTTP/network/JSON error messages — no raw exception strings leaked to clients (client.py) - Strip path/creds from displayed API URL via _safe_display_url (health.py) - Enable Ruff S (bandit) rule category in pyproject.toml - Harden container mutations to strict-only matching — no fuzzy/substring for destructive operations (docker.py) Performance: - Token-bucket rate limiter (90 tokens, 9 req/s) with 429 retry backoff (client.py) - Lazy asyncio.Lock init via _get_client_lock() — fixes event-loop module-load crash (client.py) - Double-checked locking in get_http_client() for fast-path (client.py) - Short hex container ID fast-path skips list fetch (docker.py) - Cap resource_data log content to 1 MB / 5,000 lines (manager.py) - Reset reconnect counter after 30 s stable connection (manager.py) - Move tail_lines validation to module level; enforce 10,000 line cap (storage.py, docker.py) - force_terminal=True removed from logging RichHandler (logging.py) Architecture: - Register diagnostic tools in server startup (server.py) - Move ALL_ACTIONS computation to module level in all tools - Consolidate format_kb / format_bytes into shared core/utils.py - Add _safe_get() helper in core/utils.py for nested dict traversal - Extract _analyze_subscription_status() from health.py diagnose handler - Validate required config at startup — fail fast with CRITICAL log (server.py) Code quality: - Remove ~90 lines of dead Rich formatting helpers from logging.py - Remove dead self.websocket attribute from SubscriptionManager - Remove dead setup_uvicorn_logging() wrapper - Move _VALID_IMPORTANCE to module level (N806 fix) - Add slots=True to all three dataclasses (SubscriptionData, SystemHealth, APIResponse) - Fix None rendering as literal "None" string in info.py summaries - Change fuzzy-match log messages from INFO to DEBUG (docker.py) - UTC-aware datetimes throughout (manager.py, diagnostics.py) Infrastructure: - Upgrade base image python:3.11-slim → python:3.12-slim (Dockerfile) - Add non-root appuser (UID/GID 1000) with HEALTHCHECK (Dockerfile) - Add read_only, cap_drop: ALL, tmpfs /tmp to docker-compose.yml - Single-source version via importlib.metadata (pyproject.toml → __init__.py) - Add open_timeout to all websockets.connect() calls Tests: - Update error message matchers to match sanitised messages (test_client.py) - Fix patch targets for UNRAID_API_URL → utils module (test_subscriptions.py) - Fix importance="info" → importance="normal" (test_notifications.py, http_layer) - Fix naive datetime fixtures → UTC-aware (test_subscriptions.py) Co-authored-by: Claude <claude@anthropic.com>
49 lines
1.5 KiB
Docker
49 lines
1.5 KiB
Docker
# Use an official Python runtime as a parent image
|
|
FROM python:3.12-slim
|
|
|
|
# Set the working directory in the container
|
|
WORKDIR /app
|
|
|
|
# Install uv
|
|
COPY --from=ghcr.io/astral-sh/uv:latest /uv /uvx /usr/local/bin/
|
|
|
|
# Create non-root user with home directory and give ownership of /app
|
|
RUN groupadd --gid 1000 appuser && \
|
|
useradd --uid 1000 --gid 1000 --create-home --shell /bin/false appuser && \
|
|
chown appuser:appuser /app
|
|
|
|
# Copy dependency files (owned by appuser via --chown)
|
|
COPY --chown=appuser:appuser pyproject.toml .
|
|
COPY --chown=appuser:appuser uv.lock .
|
|
COPY --chown=appuser:appuser README.md .
|
|
COPY --chown=appuser:appuser LICENSE .
|
|
|
|
# Copy the source code
|
|
COPY --chown=appuser:appuser unraid_mcp/ ./unraid_mcp/
|
|
|
|
# Switch to non-root user before installing dependencies
|
|
USER appuser
|
|
|
|
# Install dependencies and the package
|
|
RUN uv sync --frozen
|
|
|
|
# Make port UNRAID_MCP_PORT available to the world outside this container
|
|
# Defaulting to 6970, but can be overridden by environment variable
|
|
EXPOSE 6970
|
|
|
|
# Define environment variables (defaults, can be overridden at runtime)
|
|
ENV UNRAID_MCP_PORT=6970
|
|
ENV UNRAID_MCP_HOST="0.0.0.0"
|
|
ENV UNRAID_MCP_TRANSPORT="streamable-http"
|
|
ENV UNRAID_API_URL=""
|
|
ENV UNRAID_API_KEY=""
|
|
ENV UNRAID_VERIFY_SSL="true"
|
|
ENV UNRAID_MCP_LOG_LEVEL="INFO"
|
|
|
|
# Health check
|
|
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
|
|
CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:6970/mcp')"]
|
|
|
|
# Run unraid-mcp-server when the container launches
|
|
CMD ["uv", "run", "unraid-mcp-server"]
|