mirror of
https://github.com/open-jarvis/OpenJarvis.git
synced 2026-07-28 05:12:26 +00:00
Elliot SluskyandGitHub
5bc8d3a2f6
Pin all base images and ollama to fixed versions + @sha256 digests (no floating :latest), run Docker images as an unprivileged openjarvis user (uid 10001), replace the curl|bash NodeSource install with a digest-pinned multi-stage copy, install from the committed uv.lock via uv export --frozen --no-dev (hash-verified, --no-deps), and add systemd sandboxing (NoNewPrivileges, ProtectSystem=strict, PrivateTmp, kernel/SUID protections). Closes #228, #563, #564, #565, #566, #567.
38 lines
1.2 KiB
YAML
38 lines
1.2 KiB
YAML
services:
|
|
jarvis:
|
|
build:
|
|
context: ../..
|
|
dockerfile: deploy/docker/Dockerfile
|
|
ports:
|
|
- "8000:8000"
|
|
environment:
|
|
- OPENJARVIS_ENGINE_DEFAULT=ollama
|
|
- OLLAMA_HOST=http://ollama:11434
|
|
# The container binds 0.0.0.0, so an API key is REQUIRED. Compose fails
|
|
# fast if OPENJARVIS_API_KEY is unset (set it in deploy/docker/.env —
|
|
# see .env.example, or `export` it). Generate one: `jarvis auth generate-key`.
|
|
- OPENJARVIS_API_KEY=${OPENJARVIS_API_KEY:?OPENJARVIS_API_KEY must be set (see deploy/docker/.env.example)}
|
|
depends_on:
|
|
ollama:
|
|
condition: service_healthy
|
|
restart: unless-stopped
|
|
|
|
ollama:
|
|
# Pinned to a fixed version + digest for reproducible deployments and
|
|
# predictable rollbacks (#563). Bump deliberately, not implicitly via :latest.
|
|
image: ollama/ollama:0.30.10@sha256:bfc9c6d53cc6989aa5131a6fde6b162b2802d4d337657f3253b5f69579bddeee
|
|
ports:
|
|
- "11434:11434"
|
|
volumes:
|
|
- ollama-models:/root/.ollama
|
|
healthcheck:
|
|
test: ["CMD", "ollama", "list"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
start_period: 10s
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
ollama-models:
|