Docker: smaller hardened runtime image #2833

Which client?

All / shared core

The problem

The runtime image is node:22-slim with the tarball installed globally: the base is not pinned by digest, transitive dependencies are resolved fresh at build time rather than from the lockfile CI tested, install scripts run, and Node runs as PID 1 without an init to reap orphaned grandchildren (which npx-launched stdio servers create).

Solution you have in mind (optional)

• Builder: npm ci instead of npm install.
• Ship an npm-shrinkwrap.json (or install from the lockfile) so the image runs the tested dependency tree.
• Runtime: npm install -g --ignore-scripts, base pinned by digest, tini as entrypoint (or document docker run --init), optionally a distroless/alpine variant.
• Healthcheck probes /healthz.

Alternatives or workarounds you have tried

docker run --init covers the PID 1 part today but is not documented in docs/docker.md.

Already built it locally?

No response

Before you submit

• I searched existing issues and this is not a duplicate.
• This is a request for the Inspector itself, not for the MCP specification or an SDK.