michal/mcpctl
1
0
Fork 0
Code Issues Pull Requests 7 Actions Packages Projects Releases Wiki Activity

feat(gitea): rebuild gitea-mcp on a shell-bearing base #122

Merged
michal merged 1 commits from feat/gitea-mcp-shell-base into main 2026-08-21 10:16:29 +00:00
Conversation 0 Commits 1 Files Changed 2 +72
michal commented 2026-08-21 10:16:25 +00:00
Owner
Copy Link

Upstream gitea-mcp-server is distroless with no /bin/sh, so it cannot source the OpenBao-rendered secrets file — the only server in the fleet blocked from secretDelivery: injector, and so the only one whose token must stay inline in its pod spec.

Copies the static Go binary onto debian:stable-slim, following the deploy/Dockerfile.docmost-mcp precedent. ca-certificates added because the binary talks HTTPS and the distroless trust store is left behind. Verified in the built image: shell, binary and CA certs all present.

Upstream gitea-mcp-server is distroless with no /bin/sh, so it cannot source the OpenBao-rendered secrets file — the only server in the fleet blocked from secretDelivery: injector, and so the only one whose token must stay inline in its pod spec. Copies the static Go binary onto debian:stable-slim, following the deploy/Dockerfile.docmost-mcp precedent. ca-certificates added because the binary talks HTTPS and the distroless trust store is left behind. Verified in the built image: shell, binary and CA certs all present.
michal added 1 commit 2026-08-21 10:16:26 +00:00
feat(gitea): rebuild gitea-mcp on a shell-bearing base
Some checks failed
CI/CD / lint (pull_request) Successful in 1m20s
Details
CI/CD / test (pull_request) Successful in 1m30s
Details
CI/CD / typecheck (pull_request) Successful in 2m52s
Details
CI/CD / smoke (pull_request) Failing after 2m1s
Details
CI/CD / build (pull_request) Successful in 2m23s
Details
CI/CD / publish (pull_request) Has been skipped
Details
f097c0f4d5 
Upstream docker.gitea.com/gitea-mcp-server is distroless — `Cmd` is
["/app/gitea-mcp"] and there is no /bin/sh at any path (verified by
exec'ing every candidate against the running pod).

That is fine until the server wants secretDelivery: injector. The OpenBao
agent renders secrets to a FILE, so mcpd wraps the container command as
`sh -c '. /vault/secrets/<name>; exec "$0" "$@"'`, which needs a shell.
gitea was the only server in the fleet blocked on this, and so the only
one whose token had to stay inline in its pod spec.

Copying one static Go binary onto debian:stable-slim is cheaper than
building and maintaining a static envexec shim, and follows the precedent
in deploy/Dockerfile.docmost-mcp — this repo already rebuilds third-party
MCP servers when it needs to change how they run.

ca-certificates is required rather than incidental: the binary talks HTTPS
to mysources.co.uk and the distroless base shipped a trust store we are
leaving behind. Verified in the built image: shell present, binary runs,
ca-certificates.crt present.

ENTRYPOINT is kept so the plain (non-injected) path behaves exactly like
upstream; mcpd replaces it with the sourcing wrapper only when the server
opts in.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018vybEitX4FykeMatKe5Xki
michal merged commit 7716e424f9 into main 2026-08-21 10:16:29 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
michal
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: michal/mcpctl#122
Delete Branch "feat/gitea-mcp-shell-base"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?