Dockerfile•1.37 kB
# Use a Python image with uv pre-installed
FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim AS uv
RUN useradd -m -u 10001 app
USER app
# Install the project into `/app`
WORKDIR /app
# Enable bytecode compilation
ENV UV_COMPILE_BYTECODE=1
# Copy from the cache instead of linking since it's a mounted volume
ENV UV_LINK_MODE=copy
ENV PATH="/app/.venv/bin:${PATH}"
# Copy just these files and install dependencies to improve caching
COPY --chown=app pyproject.toml .
COPY --chown=app uv.lock .
# Install the project's dependencies using the lockfile and settings
RUN --mount=type=cache,target=/root/.cache/uv \
uv sync --frozen --no-install-project --no-dev --no-editable
# Then, add the rest of the project source code and install it
# Installing separately from its dependencies allows optimal layer caching
COPY --chown=app . .
RUN --mount=type=cache,target=/root/.cache/uv \
uv pip install .
RUN --mount=type=secret,id=semgrep_app_token,required=true,env=SEMGREP_APP_TOKEN,uid=10001,gid=10001,mode=0440 \
uv run semgrep install-semgrep-pro
# Clear out any detritus from the pro install (especially credentials)
RUN rm -rf /home/app/.semgrep
EXPOSE 8000
# expose the server to the outside world otherwise it will only be accessible from inside the container
ENV FASTMCP_HOST=0.0.0.0
ENTRYPOINT ["semgrep-mcp"]
CMD ["-t", "streamable-http"]