Dockerfile

FROM node:24-slim AS build

WORKDIR /app
COPY package.json package-lock.json tsconfig.json ./
COPY src/ src/
RUN npm ci --ignore-scripts && npm run build

FROM node:24-slim

# Runtime dependencies.
#   lsof   — required by proc_port_who on Linux.
#   procps — used by spawned commands that call `ps`.
#   tini   — PID-1 init, reaps orphaned grandchildren that survive our supervised commands.
RUN apt-get update && apt-get install -y --no-install-recommends \
    lsof procps tini ca-certificates \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /app

COPY --chown=node:node package.json package-lock.json ./
RUN npm ci --omit=dev --ignore-scripts && chown -R node:node /app

COPY --from=build --chown=node:node /app/dist/ dist/

# The `node` user is shipped by the official image.
USER node

# Bind to all interfaces inside the container so the host can connect.
# In this config an API key is REQUIRED; the server refuses to start otherwise
# (see the insecure-default check in src/index.ts). Pass PROC_MCP_API_KEY.
ENV PROC_MCP_HOST=0.0.0.0
EXPOSE 7778

ENTRYPOINT ["/usr/bin/tini", "--", "node", "dist/index.js"]