The images created /srv/metacrypt and chowned it to a non-root user with
VOLUME + USER, which fails to unpack under rootless podman (mkdir
/srv/metacrypt: operation not permitted). MCP bind-mounts /srv/metacrypt
and runs --user 0:0, so none of that is needed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add [sso].public_url: the browser-facing MCIAS base URL for the SSO
authorize redirect, kept separate from [mcias].server_url (the internal
address used for the server-to-server code exchange). Enables public SSO
without routing internal auth through the edge. Bumps mcdsl to v1.9.0.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Kyle IsomandClaude Opus 4.8