MagpieMcp/podman-compose.yml at main · THX81/MagpieMcp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
services:
  mcp-api:
    build:
      context: .
      dockerfile: Dockerfile
    ports:
      - "5066:5066"
    environment:
      - ASPNETCORE_ENVIRONMENT=Production
      - McpTools__Tools__0__UrlTemplate=http://searxng:8080/search?q={0}&format=json
    depends_on:
      searxng:
        condition: service_healthy
    networks:
      - mcp-internal  # Can only talk to SearXNG, no outbound internet
    restart: unless-stopped
    # Resource limits
    mem_limit: 128m
    cpus: 0.25
    # Security hardening
    read_only: true
    tmpfs:
      - /tmp:size=32m
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

  searxng:
    image: docker.io/searxng/searxng:latest
    volumes:
      - ./searxng:/etc/searxng:rw
    # No host ports exposed - only reachable from mcp-api via internal network
    environment:
      - SEARXNG_BASE_URL=http://searxng:8080/
    healthcheck:
      test: ["CMD", "wget", "--spider", "--quiet", "http://localhost:8080/healthz"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 10s
    networks:
      - mcp-internal  # Accepts requests from mcp-api
      - searxng-egress  # Outbound internet for querying search engines
    restart: unless-stopped
    # Resource limits
    mem_limit: 256m
    cpus: 0.5
    # Security hardening
    read_only: true
    tmpfs:
      - /tmp:size=64m
      - /etc/ssl/certs:size=64m
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

networks:
  mcp-internal:
    # Isolated bridge - no outbound internet
    driver: bridge
  searxng-egress:
    # Bridge with internet access for SearXNG to reach search engines
    driver: bridge