Skip to content

fix: enable analytics by default in Dockerfile.mcp - #626

Merged
shivasurya merged 1 commit into
mainfrom
fix/dockerfile-mcp-enable-analytics
Mar 29, 2026
Merged

shivasurya merged 1 commit into
mainfrom
fix/dockerfile-mcp-enable-analytics

Conversation

@shivasurya

Copy link
Copy Markdown
Owner

Summary

  • Remove --disable-metrics from ENTRYPOINT in Dockerfile.mcp
  • Anonymous usage analytics now enabled by default in Docker MCP image
  • Users can opt out by appending --disable-metrics to container args

Context

Prerequisite for Docker MCP Catalog submission. The server.yaml in docker/mcp-registry will include us.i.posthog.com in allowHosts.

Remove --disable-metrics from ENTRYPOINT so anonymous usage analytics
are enabled by default. Users can still opt out by appending
--disable-metrics to the container args.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@shivasurya shivasurya added chore docker Docker/Dockerfile related changes labels Mar 29, 2026
@shivasurya shivasurya self-assigned this Mar 29, 2026
@safedep

safedep Bot commented Mar 29, 2026 •

Copy link
Copy Markdown

SafeDep Report Summary

Green Malicious Packages Badge Green Vulnerable Packages Badge Green Risky License Badge

No dependency changes detected. Nothing to scan.

View complete scan results: 🔗 Here

This report is generated by SafeDep Github App

@github-actions

Copy link
Copy Markdown

Code Pathfinder Security Scan

Issues Found Critical High Medium Low Info

Findings

Severity File Line Issue
🟡 Medium Dockerfile.mcp 25 Missing pipefail in Shell Commands 🔗
🟡 Medium Dockerfile.mcp 45 Multiple ENTRYPOINT Instructions 🔗
🟡 Medium Dockerfile.mcp 15 Sudo Usage in Dockerfile 🔗
🟡 Medium Dockerfile.mcp 22 Sudo Usage in Dockerfile 🔗
🟡 Medium Dockerfile.mcp 25 Sudo Usage in Dockerfile 🔗
🟡 Medium Dockerfile.mcp 30 Sudo Usage in Dockerfile 🔗
🟡 Medium Dockerfile.mcp 33 Sudo Usage in Dockerfile 🔗
🔵 Low Dockerfile.mcp 15 apt-get Without --no-install-recommends 🔗
🔵 Low Dockerfile.mcp 15 Remove apt Package Lists 🔗
🔵 Low Dockerfile.mcp 45 Prefer JSON Notation for CMD/ENTRYPOINT 🔗
🔵 Low Dockerfile.mcp 12 Use Absolute Path in WORKDIR 🔗
🔵 Low Dockerfile.mcp 15 Missing -y flag for apt-get 🔗
🔵 Low Dockerfile.mcp 15 Prefer apt-get over apt 🔗
🔵 Low Dockerfile.mcp 22 Prefer apt-get over apt 🔗
🔵 Low Dockerfile.mcp 25 Prefer apt-get over apt 🔗
🔵 Low Dockerfile.mcp 30 Prefer apt-get over apt 🔗
🔵 Low Dockerfile.mcp 33 Prefer apt-get over apt 🔗
🔵 Low Dockerfile.mcp 15 Nonsensical Command 🔗
🔵 Low Dockerfile.mcp 22 Nonsensical Command 🔗
🔵 Low Dockerfile.mcp 25 Nonsensical Command 🔗
🔵 Low Dockerfile.mcp 30 Nonsensical Command 🔗
🔵 Low Dockerfile.mcp 33 Nonsensical Command 🔗
🔵 Low Dockerfile.mcp 15 Nonsensical Command 🔗
🔵 Low Dockerfile.mcp 22 Nonsensical Command 🔗
🔵 Low Dockerfile.mcp 25 Nonsensical Command 🔗
🔵 Low Dockerfile.mcp 30 Nonsensical Command 🔗
🔵 Low Dockerfile.mcp 33 Nonsensical Command 🔗
🔵 Low Dockerfile.mcp 22 pip install Without --no-cache-dir 🔗
Metric Value
Files Scanned 1
Rules 205

Powered by Code Pathfinder

Comment thread Dockerfile.mcp
# Analytics disabled in container mode (no consent mechanism)
ENTRYPOINT ["/usr/bin/pathfinder", "serve", "--project", "/project", "--disable-metrics"]
# To disable analytics, add --disable-metrics flag
ENTRYPOINT ["/usr/bin/pathfinder", "serve", "--project", "/project"]

Check warning

Code scanning / Code Pathfinder

Dockerfile has multiple ENTRYPOINT instructions. Only the last one takes effect, making earlier ones misleading. (CWE-710) Medium

Dockerfile has multiple ENTRYPOINT instructions. Only the last one takes effect, making earlier ones misleading.
Comment thread Dockerfile.mcp
# Analytics disabled in container mode (no consent mechanism)
ENTRYPOINT ["/usr/bin/pathfinder", "serve", "--project", "/project", "--disable-metrics"]
# To disable analytics, add --disable-metrics flag
ENTRYPOINT ["/usr/bin/pathfinder", "serve", "--project", "/project"]

Check notice

Code scanning / Code Pathfinder

Use JSON notation (exec form) for CMD/ENTRYPOINT for proper signal handling. (CWE-710) Low

Use JSON notation (exec form) for CMD/ENTRYPOINT for proper signal handling.
@shivasurya
shivasurya merged commit 7c5187c into main Mar 29, 2026
3 checks passed
@shivasurya
shivasurya deleted the fix/dockerfile-mcp-enable-analytics branch March 29, 2026 15:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

chore docker Docker/Dockerfile related changes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants