Proposal: File system permissions for MCP servers running in Docker containers

[Mossaka]

For MCP servers running in docker containers using the container: syntax, we need a way to grant file system access via volume mounting. You should design a new syntax that allows the frontmatter in the markdown to epxress

permissions:
  storage:
      allow:
      - uri: fs://tmp/mcp-filesystem
        access: [read]

The storage will take a list of allowed fs paths and compile them down into volume mounts for docker containers in the GitHub Action YAML files.

[github-actions]

🎯 Agentic Issue Triage

Summary: This issue requests implementing filesystem permissions for MCP servers running in Docker containers, enabling secure volume mounting through a new frontmatter syntax for storage permissions.

📋 Implementation Analysis

Key Requirements:

• Design new frontmatter syntax for filesystem permissions (permissions.storage.allow)
• Support fs:// URIs with read/write access controls
• Compile permissions to Docker volume mounts in GitHub Actions YAML
• Integrate with existing container: syntax for MCP servers

Related Work:

• 🔗 Issue githubnext/gh-aw-internal#546: Unix-style read/write permissions for containers (similar scope)
• 🔗 Issue Proposal: Network permissions for MCP servers with Squid Proxy gh-aw#78: Network permissions with Squid proxy (parallel security feature)
• 🔗 PR githubnext/gh-aw-internal#718: Already in progress by @Copilot (draft implementation)

Architecture Impact:

• pkg/parser/mcp.go: Extend MCPServerConfig with filesystem permissions
• pkg/workflow/compiler.go: Generate Docker volume mount configurations
• Schema updates for frontmatter validation
• Integration with existing container orchestration

🔧 Implementation Strategy

Development Checklist:

• Extend MCPServerConfig struct with filesystem permissions field
• Update frontmatter parsing to handle permissions.storage section
• Create volume mount generation functions for Docker containers
• Update workflow compiler to integrate filesystem permissions
• Add validation for filesystem paths and access modes
• Create comprehensive tests for parsing and compilation
• Update documentation and examples

Technical Considerations:

• Path validation and sanitization (security critical)
• Support for multiple filesystem access modes (read, write, readwrite)
• Docker volume mount syntax generation
• Integration with GitHub Actions runner filesystem constraints
• Error handling for invalid filesystem paths

🔒 Security Implications

Security Priorities:

• Input validation for filesystem paths to prevent directory traversal
• Access mode enforcement (read-only vs read-write)
• Container isolation maintenance
• Audit logging for filesystem access requests

Best Practices:

• Use allowlist approach (explicit permissions only)
• Validate against known safe filesystem patterns
• Consider implementing path canonicalization
• Document security boundaries and limitations

📚 Resources & References

Docker Documentation:

• Docker Volume Mounts
• Container Security Best Practices

GitHub Actions:

• Container Actions
• Workflow Security

Related Codebase Files:

• pkg/parser/mcp.go - MCP configuration parsing
• pkg/workflow/compiler.go - Workflow compilation logic
• CLAUDE.md - Project development guidelines

Priority: High - This is foundational security infrastructure for the MCP ecosystem, enabling safe filesystem access patterns for containerized agents.

AI-generated content by Agentic Triage may contain mistakes.

[github-actions]

Assigning to @Mossaka as this relates to MCP server Docker container permissions, an area where you have expertise based on your related proposals (#90, github/gh-aw#175, github/gh-aw#1056, github/gh-aw#3175).

🏴‍☠️ Ahoy! This treasure was crafted by Auto-Assign Issue

[github-actions]

Assigned to @pelikhan based on recent contributions to MCP-related features and Docker integration work in the repository.

Ahoy! This treasure was crafted by 🏴‍☠️ Auto-Assign Issue

[github-actions]

👋 Assigned to @Mossaka based on your expertise with MCP server container configurations and security features. This issue aligns with your work on container security proposals (#90, github/gh-aw#175).

Ahoy! This treasure was crafted by 🏴‍☠️ Auto-Assign Issue