Fix docker-compose integration test: volume permissions and async fetch

The mcp-js container runs as non-root mcpuser (UID 1000) but the /data
directory never existed in the Docker image. When Docker mounted a named
volume at /data, it was created as root-owned, so the server could not
write heap snapshots — causing every /api/exec request to return HTTP 500
("Error saving heap") and the health check to never pass.

Fixes:
- Dockerfile: create /data with mcpuser ownership before USER switch
- docker-compose.yml: use tmpfs for /data (world-writable, works with
  the existing published image without waiting for a new Docker build)
- Test script: print container logs and status on health check failure
- Test script: wrap fetch() calls in async IIFE since fetch() is now
  async on main (returns a Promise)
- CI workflow: trigger on Dockerfile changes too

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: r33drichards

.github/workflows/docker-compose-integration.yml

@@ -4,12 +4,14 @@ on:
   push:
     branches: [main]
     paths:
+      - Dockerfile
       - docker-compose.yml
       - policies/**
       - tests/docker-compose-integration.sh
   pull_request:
     branches: [main]
     paths:
+      - Dockerfile
       - docker-compose.yml
       - policies/**
       - tests/docker-compose-integration.sh

Dockerfile

@@ -38,6 +38,9 @@ COPY --from=builder /app/server/target/release/server /usr/local/bin/mcp-v8
 # Set ownership
 RUN chown mcpuser:mcpuser /usr/local/bin/mcp-v8
 
+# Create default data directory for stateful mode (heaps, sessions, etc.)
+RUN mkdir -p /data && chown mcpuser:mcpuser /data
+
 # Switch to non-root user
 USER mcpuser
 

docker-compose.yml

@@ -15,12 +15,9 @@ services:
       - --directory-path=/data/heaps
       - --session-db-path=/data/sessions
       - --opa-url=http://opa:8181
-    volumes:
-      - mcp-js-data:/data
+    tmpfs:
+      - /data
     ports:
       - "3000:3000"
     depends_on:
       - opa
-
-volumes:
-  mcp-js-data:

tests/docker-compose-integration.sh

@@ -54,6 +54,15 @@ wait_for_ready() {
     i=$((i + 1))
   done
   echo "  ERROR: mcp-js did not become ready in time."
+  echo ""
+  echo "==> Container status:"
+  docker compose -f "$COMPOSE_FILE" ps
+  echo ""
+  echo "==> mcp-js logs:"
+  docker compose -f "$COMPOSE_FILE" logs mcp-js
+  echo ""
+  echo "==> opa logs:"
+  docker compose -f "$COMPOSE_FILE" logs opa
   exit 1
 }
 
@@ -87,7 +96,7 @@ fi
 
 echo ""
 echo "==> Test 2: fetch() to allowed domain (registry.npmjs.org)"
-RESULT=$(exec_js '{"code":"const r = fetch(\"https://registry.npmjs.org/\"); r.ok;"}')
+RESULT=$(exec_js '{"code":"(async () => { const r = await fetch(\"https://registry.npmjs.org/\"); return r.ok; })()"}')
 OUTPUT=$(echo "$RESULT" | jq -r '.output')
 if [ "$OUTPUT" = "true" ]; then
   pass "fetch() to allowed domain returned ok=true"
@@ -101,7 +110,7 @@ echo ""
 echo "==> Test 3: fetch() to blocked domain (evil.example.com)"
 HTTP_CODE=$(curl -s -o /tmp/mcp-test-deny.json -w "%{http_code}" -X POST "$BASE_URL/api/exec" \
   -H "Content-Type: application/json" \
-  -d '{"code":"fetch(\"https://evil.example.com/\");"}')
+  -d '{"code":"(async () => { const r = await fetch(\"https://evil.example.com/\"); return r.ok; })()"}')
 BODY=$(cat /tmp/mcp-test-deny.json)
 if [ "$HTTP_CODE" = "500" ] && echo "$BODY" | grep -qi "denied\|policy"; then
   pass "fetch() to blocked domain was denied by policy (HTTP $HTTP_CODE)"