Pin all base images and ollama to fixed versions + @sha256 digests (no floating :latest), run Docker images as an unprivileged openjarvis user (uid 10001), replace the curl|bash NodeSource install with a digest-pinned multi-stage copy, install from the committed uv.lock via uv export --frozen --no-dev (hash-verified, --no-deps), and add systemd sandboxing (NoNewPrivileges, ProtectSystem=strict, PrivateTmp, kernel/SUID protections). Closes#228, #563, #564, #565, #566, #567.
* fix: copy package includes in Docker build
* fix: copy package includes in GPU Docker builds too
PR #450 fixed the CPU Dockerfile but Dockerfile.gpu and
Dockerfile.gpu.rocm have the identical bug: they COPY src/ then
`uv pip install ".[server]"` without copying the non-src
force-include paths (scripts/install, deploy/windows), so hatchling's
wheel build fails the same way on GPU images (#447).
Adds the two COPY lines to both GPU Dockerfiles and generalizes the
regression test to guard every wheel-building Dockerfile (CPU + both
GPU variants) instead of only the CPU one.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Jon Saad-Falcon <41205309+jonsaadfalcon@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: nvidia gpu config for docker
* refactor: split NVIDIA GPU support into compose override
Address review feedback:
- Revert --engine ollama from base Dockerfile CMD (breaks non-Ollama users)
- Keep bookworm pin and OLLAMA_HOST fix in base config
- Move GPU-specific config (/proc, /sys mounts, deploy.resources.reservations)
into new docker-compose.gpu.nvidia.yml override, matching the existing ROCm
pattern (docker-compose.gpu.rocm.yml)
- Restore Ollama port to standard 11434
- Remove commented-out GPU blocks from base docker-compose.yml
- Add Ollama healthcheck with depends_on condition to base compose
- Remove run.sh from repo root
- Rewrite README Docker section to document CPU, NVIDIA, and ROCm patterns
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Jon Saad-Falcon <41205309+jonsaadfalcon@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
