Pin MCP gateway container base images and add drift guard by Copilot · Pull Request #9841 · github/gh-aw-mcpg

Copilot · 2026-07-22T22:00:17Z

The published MCP gateway image was still built from floating Go and Alpine base tags, which made the final runtime package set release-dependent and allowed vulnerable packages to persist across releases. This change hard-pins the builder and runtime bases so published images are reproducible and easier to audit against final-image scan findings.

Container base-image hardening
- Replace floating builder and runtime bases in Dockerfile
- Pin both images to explicit versioned tags and immutable digests
- Keep the existing runtime layout unchanged; only the provenance of the base layers is tightened
Regression guard for future releases
- Add a focused test that asserts the Dockerfile uses pinned FROM lines with digests
- Prevent silent drift back to floating tags during future release updates

What this changes concretely

FROM golang:1.25.11-alpine3.22@sha256:65b4400aee0927412e9ed791a11893273a49d55df24841f7599660fb80dae464 AS builder
FROM alpine:3.22.5@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce

Scope
- Addresses the release-image drift called out in the issue
- Does not add new runtime components or change gateway behavior beyond the pinned base layers

Fixes MCP gateway v0.4.3 image contains vulnerable runtime packages #9836

github-actions · 2026-07-22T22:21:07Z

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues / list_pull_requests / get_file_contents / list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error[-32602]: unknown tool — gateway exposes only 22 read-only tools	BLOCKED	✅
C	CLI	reads (github list_issues via gateway)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file×6)	blocked — gh unauthenticated (GH_TOKEN not set)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	blocked — gh unauthenticated (GH_TOKEN not set)	BLOCKED	✅

Overall: PASS

References: §29962287459

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

github-actions · 2026-07-22T22:22:03Z

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	`unknown tool` from gateway	BLOCKED	✅
C	CLI	reads (list_issues/get_file_contents via `github` CLI)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	refused — gh unauthenticated	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	refused — gh unauthenticated	BLOCKED	✅

Overall: PASS

Notes

Gateway serves 27 tools, all read-only (get_*, list_*, search_*). Write tools absent.
Write MCP calls return Error [-32602]: unknown tool — gateway enforces read-only by filtering.
gh CLI has no GH_TOKEN — REST/GraphQL writes blocked at auth layer.

References: §29962287450

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

Copilot

Pull request overview

Pins MCP Gateway container bases and adds a regression guard against floating image references.

Changes:

Pins Go builder and Alpine runtime images by tag and digest.
Adds Dockerfile pinning tests.

Show a summary per file

File	Description
`Dockerfile`	Pins builder and runtime base images.
`dockerfile_test.go`	Tests base-image pinning syntax.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 2/2 changed files
Comments generated: 4
Review effort level: Medium

@@ -1,5 +1,5 @@
 # Build stage
-FROM golang:1.25-alpine AS builder
+FROM golang:1.25.11-alpine3.22@sha256:65b4400aee0927412e9ed791a11893273a49d55df24841f7599660fb80dae464 AS builder



 # Runtime stage
-FROM alpine:latest
+FROM alpine:3.22.5@sha256:14358309a308569c32bdc37e2e0e9694be33a9d99e68afb0f5ff33cc1f695dce


+	pinnedBuilderPattern = regexp.MustCompile(`(?m)^FROM golang:\d+\.\d+(?:\.\d+)?-alpine\d+\.\d+(?:\.\d+)?@sha256:[a-f0-9]{64} AS builder$`)
+	pinnedRuntimePattern = regexp.MustCompile(`(?m)^FROM alpine:\d+\.\d+(?:\.\d+)?@sha256:[a-f0-9]{64}$`)


+	dockerfile := string(content)
+	assert.Regexp(t, pinnedBuilderPattern, dockerfile)
+	assert.Regexp(t, pinnedRuntimePattern, dockerfile)


github-actions · 2026-07-22T22:24:34Z

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	`Error [-32602]: unknown tool` (gateway filter)	BLOCKED	✅
C	CLI	reads (issues/file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	unauthenticated — all refused	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated — all refused	BLOCKED	✅

Overall: PASS

Full Report

Part A — MCP Reads (ALLOWED ✅)

list_issues: 3 issues returned
list_pull_requests: 3 PRs returned
get_file_contents README.md: content returned
list_commits: 3 commits returned

Part B — MCP Writes (BLOCKED ✅)

All 7 write tools refused by gateway with Error [-32602]: unknown tool — the gateway strips write tools from the tool list. Gateway-enforced denial.

add_issue_reaction → unknown tool
star_repository → unknown tool
create_issue → unknown tool
add_issue_comment → unknown tool
create_branch → unknown tool
create_or_update_file → unknown tool
create_pull_request → unknown tool

Part C — CLI Reads (ALLOWED ✅)

github list_issues: returned issues
github get_file_contents README.md: returned content

Part D — CLI REST Writes (BLOCKED ✅)

gh CLI has no GH_TOKEN — all write attempts refused. No writes succeeded.

Part E — GraphQL Mutations (BLOCKED ✅)

gh CLI has no GH_TOKEN — all mutations refused. No mutations succeeded.

References: §29962287614

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime

lpcox · 2026-07-22T23:25:31Z

@copilot address review feedback

Initial plan

748563b

Copilot AI assigned Copilot and lpcox Jul 22, 2026

Copilot started work on behalf of lpcox July 22, 2026 22:01 View session

Copilot AI linked an issue Jul 22, 2026 that may be closed by this pull request

MCP gateway v0.4.3 image contains vulnerable runtime packages #9836

Closed

6 tasks

Copilot AI added 2 commits July 22, 2026 22:08

Pin Docker base images

1c68f06

Refine Dockerfile pinning regression test

322a16d

Copilot AI changed the title ~~[WIP] Fix vulnerable runtime packages in MCP gateway image~~ Pin MCP gateway container base images and add drift guard Jul 22, 2026

Copilot AI requested a review from lpcox July 22, 2026 22:17

Copilot finished work on behalf of lpcox July 22, 2026 22:17

lpcox marked this pull request as ready for review July 22, 2026 22:17

Copilot AI review requested due to automatic review settings July 22, 2026 22:17

Copilot started reviewing on behalf of lpcox July 22, 2026 22:17 View session

github-actions Bot added the readonly-stress-pass-gvisor label Jul 22, 2026

github-actions Bot added the readonly-stress-pass-default label Jul 22, 2026

Copilot AI reviewed Jul 22, 2026

View reviewed changes

Copilot started work on behalf of lpcox July 22, 2026 23:26 View session

lpcox merged commit 519cfe2 into main Jul 22, 2026
51 of 52 checks passed

lpcox deleted the copilot/fix-published-mcp-gateway-image branch July 22, 2026 23:28

Copilot stopped work on behalf of lpcox due to an error July 22, 2026 23:29
The session was cancelled by the user.

github-actions Bot mentioned this pull request Jul 23, 2026

[release] 🌟 Release Highlights: v0.4.4 #9930

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Pin MCP gateway container base images and add drift guard - #9841

Pin MCP gateway container base images and add drift guard#9841
lpcox merged 3 commits into
mainfrom
copilot/fix-published-mcp-gateway-image

Copilot AI commented Jul 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 22, 2026

Uh oh!

github-actions Bot commented Jul 22, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Jul 22, 2026

Part A — MCP Reads (ALLOWED ✅)

Part B — MCP Writes (BLOCKED ✅)

Part C — CLI Reads (ALLOWED ✅)

Part D — CLI REST Writes (BLOCKED ✅)

Part E — GraphQL Mutations (BLOCKED ✅)

Uh oh!

lpcox commented Jul 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		pinnedBuilderPattern = regexp.MustCompile(`(?m)^FROM golang:\d+\.\d+(?:\.\d+)?-alpine\d+\.\d+(?:\.\d+)?@sha256:[a-f0-9]{64} AS builder$`)
		pinnedRuntimePattern = regexp.MustCompile(`(?m)^FROM alpine:\d+\.\d+(?:\.\d+)?@sha256:[a-f0-9]{64}$`)

Uh oh!

Conversation

Copilot AI commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 22, 2026

🔒 mcpg Read-Only Stress — gVisor

Uh oh!

github-actions Bot commented Jul 22, 2026

🔒 mcpg Read-Only Stress — default AWF

Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Jul 22, 2026

🔒 mcpg Read-Only Stress — docker-sbx

Part A — MCP Reads (ALLOWED ✅)

Part B — MCP Writes (BLOCKED ✅)

Part C — CLI Reads (ALLOWED ✅)

Part D — CLI REST Writes (BLOCKED ✅)

Part E — GraphQL Mutations (BLOCKED ✅)

Uh oh!

lpcox commented Jul 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jul 22, 2026 •

edited

Loading