feat: add hardened standalone container build (#624)

Co-authored-by: CharlieHelps <charlie@charlielabs.ai>

Author: charliecreates[bot]

.changeset/calm-taxis-build.md

@@ -0,0 +1,5 @@
+---
+"hevy-mcp": patch
+---
+
+Package the Docker image as a non-root standalone bundle without application `node_modules`.

.dockerignore

@@ -1,31 +1,15 @@
-.git
-.github
-.changeset
-
-.env
-.env.*
-!.env.sample
-*.pem
-*.key
-.npmrc
-
-node_modules
-dist
-coverage
-test-results
-tests
-*.tsbuildinfo
-
-*.log
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-pnpm-debug.log*
-
-.DS_Store
-Thumbs.db
-.idea
-.vscode
-*.swp
-*.swo
-*~
+# Deny everything by default so local credentials and unrelated repository
+# files are never sent to the Docker daemon or retained in its build cache.
+**
+
+# Docker must still be able to read the build definition and ignore rules.
+!Dockerfile
+!.dockerignore
+
+# Standalone build inputs.
+!package.json
+!package-lock.json
+!tsconfig.json
+!tsdown.config.ts
+!src/
+!src/**

.github/workflows/build-and-test.yml

@@ -171,6 +171,14 @@ jobs:
       - name: Smoke test help output without an API key
         run: docker run --rm hevy-mcp:ci --help
 
+      - name: Verify hardened runtime structure
+        run: |
+          docker run --rm --entrypoint sh hevy-mcp:ci -c '
+            test "$(id -u)" -ne 0 &&
+            test ! -e /app/node_modules &&
+            test -f /app/standalone.mjs
+          '
+
   otel-cicd-action:
     if: always()
     name: OpenTelemetry Export Trace

Dockerfile

@@ -1,28 +1,23 @@
 # syntax=docker/dockerfile:1
 
-FROM node:24-alpine AS build
+FROM node:lts-alpine AS build
 
 WORKDIR /app
 
 COPY package.json package-lock.json ./
 RUN npm ci
 
-COPY . .
-RUN npm run build
+COPY tsconfig.json tsdown.config.ts ./
+COPY src/ ./src/
+RUN npm run build:standalone
 
-FROM node:24-trixie-slim AS production-dependencies
-
-WORKDIR /app
-
-COPY package.json package-lock.json ./
-RUN npm ci --omit=dev && npm cache clean --force
-
-FROM gcr.io/distroless/nodejs24-debian13:nonroot AS runtime
+FROM node:lts-alpine AS runtime
 
 ENV NODE_ENV=production
 WORKDIR /app
 
-COPY --from=production-dependencies --chown=65532:65532 /app/node_modules ./node_modules
-COPY --from=build --chown=65532:65532 /app/dist ./dist
+COPY --from=build --chown=node:node /app/dist/standalone.mjs ./standalone.mjs
+
+USER node
 
-ENTRYPOINT ["/nodejs/bin/node", "dist/cli.mjs"]
+ENTRYPOINT ["node", "/app/standalone.mjs"]

README.md

@@ -103,6 +103,12 @@ The server uses stdio, so `-i` keeps standard input open for the MCP client.
 form forwards the variable from the host environment without putting the key
 in the command arguments.
 
+The image uses the official Node.js LTS Alpine base, runs as the non-root
+`node` user, and ships the application and its third-party runtime dependencies
+as a standalone bundle. It does not include an application `/app/node_modules`
+directory; the official Node base image may still contain its own globally
+packaged npm or Corepack files.
+
 Use `latest` to follow the newest stable release. For reproducible deployments,
 pin the exact version shown on the release, using a tag such as
 `ghcr.io/chrisdoc/hevy-mcp:X.Y.Z`. Major (`:X`) and major.minor (`:X.Y`) tags

package.json

@@ -50,6 +50,7 @@
 		"test:pr": "npm run test:unit && npm run test:mcp && npm run test:contract && npm run test:stdio && npm run test:pack",
 		"openapi": "node ./scripts/openapi-spec.js",
 		"build": "tsdown",
+		"build:standalone": "cross-env HEVY_MCP_BUILD_MODE=standalone tsdown",
 		"build:client": "kubb generate",
 		"prepack": "npm run check:server-manifest && npm run build",
 		"start": "node --env-file .env dist/cli.mjs",

tsdown.config.ts

@@ -19,6 +19,7 @@ try {
 }
 
 const { name, version } = parsed;
+const isStandaloneBuild = process.env.HEVY_MCP_BUILD_MODE === "standalone";
 
 if (process.env.HEVY_MCP_RELEASE === "true") {
 	const missing: string[] = [];
@@ -49,9 +50,10 @@ if (
 	);
 }
 export default defineConfig({
-	entry: ["src/index.ts", "src/cli.ts"],
+	entry: isStandaloneBuild ? ["src/cli.ts"] : ["src/index.ts", "src/cli.ts"],
 	format: ["esm"],
-	target: "esnext",
+	platform: isStandaloneBuild ? "node" : undefined,
+	target: isStandaloneBuild ? "node24" : "esnext",
 	define: {
 		__HEVY_MCP_BUILD__: "true",
 		__HEVY_MCP_NAME__: JSON.stringify(name),
@@ -60,13 +62,25 @@ export default defineConfig({
 			process.env.OTEL_COLLECTOR_TOKEN ?? "",
 		),
 	},
-	sourcemap: true,
+	sourcemap: !isStandaloneBuild,
 	clean: true,
-	dts: true,
+	dts: !isStandaloneBuild,
+	deps: isStandaloneBuild
+		? {
+				alwaysBundle: [/.*/],
+				onlyBundle: false,
+			}
+		: undefined,
 	banner: {
 		js: "#!/usr/bin/env node\n// Generated with tsdown\n// https://tsdown.dev",
 	},
 	outDir: "dist",
+	outputOptions: isStandaloneBuild
+		? {
+				codeSplitting: false,
+				entryFileNames: "standalone.mjs",
+			}
+		: undefined,
 	inputOptions: {
 		onLog(level, log, defaultHandler) {
 			if (