b9dfb86260
Security hardening release addressing CodeQL and Dependabot alerts: - Fix stack trace exposure in error responses - Add SSRF protection with DNS resolution checking - Implement proper URL hostname validation (replaces substring matching) - Add centralized path sanitization to prevent path traversal - Fix ReDoS vulnerability in email validation regex - Improve HTML sanitization in validation utilities - Fix capability wildcard matching in auth utilities - Update glob dependency to address CVE - Add CodeQL suppression comments for verified false positives 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
30 lines
794 B
YAML
30 lines
794 B
YAML
# Docker Compose ARM64 Overlay
|
|
# Platform-specific overrides for Apple Silicon (M2+)
|
|
#
|
|
# Usage: docker compose -f docker-compose.yml -f docker-compose.arm64.yml up -d
|
|
|
|
services:
|
|
# VLLM Embeddings Service - ARM64 CPU Optimized
|
|
vllm-embeddings:
|
|
platform: linux/arm64
|
|
build:
|
|
context: .
|
|
dockerfile: .deployment/docker/Dockerfile.vllm-arm
|
|
environment:
|
|
- MODEL_NAME=BAAI/bge-m3
|
|
- OMP_NUM_THREADS=8
|
|
- MKL_NUM_THREADS=8
|
|
- PYTORCH_NUM_THREADS=8
|
|
- PYTORCH_MPS_HIGH_WATERMARK_RATIO=0.0
|
|
- PYTORCH_ENABLE_MPS_FALLBACK=1
|
|
- CUDA_VISIBLE_DEVICES=""
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 4G
|
|
reservations:
|
|
memory: 3G
|
|
labels:
|
|
- "gt2.platform=arm64"
|
|
- "gt2.architecture=apple-silicon"
|