Supabase Secure Multi‑Stage MCP Server Docker Build Pack

The Supabase Secure Multi‑Stage MCP Server Docker Build Pack gives you a ready‑to‑run, production‑hardened Docker configuration that eliminates the trial‑and‑error phase of building a secure MCP Supabase server. By separating the build and runtime stages, isolating secrets, and embedding health‑checks, the pack reduces the time required to get a safe container into production from hours to minutes.

What You Get

• dockerized-mcp-server/Dockerfile.multi-stage-secure-build – a multi‑stage Dockerfile that compiles the server in a builder stage and copies only the necessary artifacts to a non‑root runtime stage.
• dockerized-mcp-server/docker-entrypoint-secure.sh – an entrypoint script that prepares the environment, validates required Supabase variables, and starts the server without exposing credentials.
• dockerized-mcp-server/mcp-server-healthcheck.sh – a lightweight health‑check that the orchestrator can call to verify the server is responding correctly.
• dockerized-mcp-server/mcp-server-nonroot-user-setup.sh – creates and switches to a dedicated non‑root user inside the container, preventing the common “run as root” vulnerability.
• dockerized-mcp-server/supabase-env-validation.js – a Node.js utility that checks the presence and format of all required Supabase environment variables before the application starts.
• dockerized-mcp-server/secure-build-args.example – a template showing the build‑time arguments you should pass to keep secrets out of the final image.
• dockerized-mcp-server/container-security-hardening.md – documentation of the hardening steps applied to the image and recommendations for further tightening.
• dockerized-mcp-server/resource-limits-production.yaml – a Kubernetes‑compatible resource‑limit manifest that enforces CPU and memory caps appropriate for production workloads.
• dockerized-mcp-server/supabase-network-policies.yaml – network‑policy definitions that restrict inbound and outbound traffic to only what the MCP server needs.
• SETUP-GUIDE.md – step‑by‑step instructions for building, configuring, and deploying the container in a typical CI/CD pipeline.
• TROUBLESHOOTING.md – a concise reference for the most common build or runtime issues and their resolutions.

How to Use

Clone the repository, copy secure-build-args.example to secure-build-args.env, and fill in your Supabase credentials. Run docker build --build-arg $(cat secure-build-args.env) -f Dockerfile.multi-stage-secure-build -t supabase-mcp-secure . to produce the hardened image. Deploy the image with the provided resource-limits-production.yaml and supabase-network-policies.yaml manifests, or integrate the image into your existing orchestrator. The entrypoint script runs the environment validation before starting the server, and the health‑check script is automatically registered via the Dockerfile’s HEALTHCHECK directive.

Who This Is For

Backend engineers who need a reliable, security‑focused container for Supabase MCP servers, DevOps teams that automate production deployments, and any project where time‑to‑secure‑deployment is a measurable cost. The pack assumes familiarity with Docker, basic Supabase configuration, and container orchestration, making it a practical shortcut for professionals who cannot afford to reinvent the secure build process.