memory-journal-mcp/docker-compose.yml at main · neverinfamous/memory-journal-mcp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
services:
  memory-journal-mcp:
    build: .
    container_name: memory-journal-mcp
    volumes:
      # Mount local data directory for persistent SQLite database
      - ./data:/app/data:rw,noexec,nosuid,nodev
    environment:
      - DB_PATH=/app/data/memory_journal.db
      - AUDIT_LOG_PATH=stderr
      # Optional: GitHub integration
      # - GITHUB_TOKEN=<your-github-token>
      # - PROJECT_REGISTRY={"my-repo":{"path":"/app/repo","project_number":1}}
      # Optional: CORS origin (default: none)
      # - MCP_CORS_ORIGIN=http://localhost:3000
      # Required for IO operations to sandbox filesystem access
      - ALLOWED_IO_ROOTS=/app/data
    read_only: true
    tmpfs:
      - /tmp:noexec,nosuid,nodev
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    networks:
      - mcp-net
    stdin_open: true
    tty: true
    # MCP stdio communication (default transport)
    command: ['node', 'dist/cli.js']
    restart: unless-stopped

  # HTTP transport service for remote access
  memory-journal-mcp-http:
    build: .
    container_name: memory-journal-mcp-http
    volumes:
      - ./data:/app/data:rw,noexec,nosuid,nodev
    environment:
      - NODE_ENV=production
      - DB_PATH=/app/data/memory_journal.db
      - MCP_HOST=0.0.0.0
      - AUDIT_LOG_PATH=stderr
      # Required for HTTP: Bearer token authentication
      - MCP_AUTH_TOKEN=${MCP_AUTH_TOKEN:?MCP_AUTH_TOKEN is required for HTTP transport in production}
      # Optional: GitHub integration
      # - GITHUB_TOKEN=<your-github-token>
      # - PROJECT_REGISTRY={"my-repo":{"path":"/app/repo","project_number":1}}
      # Optional: CORS origin (default: none)
      # - MCP_CORS_ORIGIN=http://localhost:3000
      # Required for IO operations to sandbox filesystem access
      - ALLOWED_IO_ROOTS=/app/data
    read_only: true
    tmpfs:
      - /tmp:noexec,nosuid,nodev
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    networks:
      - mcp-net
    ports:
      - '3000:3000'
    command:
      ['node', 'dist/cli.js', '--transport', 'http', '--port', '3000', '--server-host', '0.0.0.0']
    healthcheck:
      test: ['CMD', 'curl', '-f', 'http://localhost:3000/health']
      interval: 30s
      timeout: 10s
      retries: 3
    restart: unless-stopped
    deploy:
      resources:
        limits:
          memory: 1g
          cpus: '1.0'
    profiles:
      - http

networks:
  mcp-net:
    driver: bridge