open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-22 19:29:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): harden copilot mcp host deployment

Browse Source
This commit is contained in:
whyour
2026-08-16 03:41:38 +08:00
parent 58025ede55
commit da4e7cf688
25 changed files with 734 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/mcp/ql3-cluster-copilot/README.md
+67
View File
@@ -0,0 +1,67 @@
# Cluster Copilot MCP stdio container
This is an explicit host-side deployment for the bounded Cluster Copilot MCP.
It is not a Kubernetes Deployment or Service: stdio must be owned by the MCP
host that launches the process. A resident Pod without that parent session
would be unreachable while still retaining a credential and image attack
surface.
The launcher uses the existing independently released Cluster Admin image and
its default `ql3-cluster-admin` entrypoint. It selects the reviewed
`copilot-mcp` subcommand, never overrides the entrypoint and never mounts a
Kubernetes token, database credential, Docker socket or writable directory.
## Prepare the private projection
Create an absolute canonical directory owned by UID/GID `10001:10001`, mode
`0700`. Copy `mcp-config.example.json` to `mcp.json` and
`client-config.example.json` to `client.json`; install the reviewed API CA as
`ca.pem` and the separately issued `ql3c_` Project API credential as
`credential`. All four files must be regular, non-symlink, UID 10001-owned,
canonical files with mode `0600`. Never put the credential value in the MCP
host config, argv, environment or image.
Replace the endpoint, DNS server name and CA. The client uses TLS 1.3, does not
use a client certificate, proxy, redirect or ambient CA, and rereads
`credential` for every Tool call.
## Select resources and egress
Create a dedicated Docker network whose host firewall permits only DNS and the
reviewed Cluster API destination. The launcher rejects `bridge`, `default`,
`host`, `none` and an implicit network, but Docker network naming alone is not
an egress allowlist.
| Resource class | Memory | CPU | PIDs | Maximum configured concurrency |
| --- | ---: | ---: | ---: | ---: |
| `compact` | 192 MiB | 0.25 | 32 | 1 |
| `standard` | 512 MiB | 1 | 64 | 4 |
| `dense` | 1 GiB | 2 | 96 | 16 |
The launcher passes a second concurrency ceiling to the process. Startup and
preflight fail closed if `mcp.json` requests more concurrency than its resource
class. There is no queue, retry, poller, watcher or resident health timer.
Export only the immutable image digest, private directory path, dedicated
network name and resource class, then validate before registering the host:
```sh
deploy/mcp/ql3-cluster-copilot/docker-stdio.sh check
```
The check validates all mounted path/credential authority and makes one
unauthenticated `GET /readyz`. Its JSON contains no endpoint, path, credential
or cluster identity. A not-ready response exits 69; invalid local authority or
transport failure emits only a low-sensitive failure fact.
Copy `mcp-host.example.json` into the external MCP host's private
configuration, replace its launcher path, image digest, private root and
network, and map its `command`/`args`/`env` fields to the host's equivalent
stdio process adapter. `serve` runs Docker attached to stdin/stdout with a
read-only root filesystem, no capabilities, no-new-privileges, a fixed
non-root UID, bounded memory/CPU/PIDs and `--pull never`.
Do not compose this directory into Edge/Standalone, `cluster-control`, the
Cluster AI Pod or any shared Kubernetes operations Kustomization. Small router
profiles continue to use the separately bounded Local MCP artifact only when
explicitly selected; otherwise they carry no MCP dependency at all.