b9dfb86260
Security hardening release addressing CodeQL and Dependabot alerts: - Fix stack trace exposure in error responses - Add SSRF protection with DNS resolution checking - Implement proper URL hostname validation (replaces substring matching) - Add centralized path sanitization to prevent path traversal - Fix ReDoS vulnerability in email validation regex - Improve HTML sanitization in validation utilities - Fix capability wildcard matching in auth utilities - Update glob dependency to address CVE - Add CodeQL suppression comments for verified false positives 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
77 lines
2.0 KiB
YAML
77 lines
2.0 KiB
YAML
# Docker Compose x86_64 Overlay
|
|
# Platform-specific overrides for x86_64 Linux (Ubuntu)
|
|
#
|
|
# Usage: docker compose -f docker-compose.yml -f docker-compose.x86.yml up -d
|
|
|
|
services:
|
|
# Control Panel Backend - x86 host.docker.internal
|
|
control-panel-backend:
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
- "ollama-host:host-gateway"
|
|
environment:
|
|
ENVIRONMENT: production
|
|
DEBUG: "false"
|
|
|
|
# Tenant Backend - x86 host.docker.internal
|
|
tenant-backend:
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
- "ollama-host:host-gateway"
|
|
environment:
|
|
ENVIRONMENT: production
|
|
DEBUG: "false"
|
|
|
|
# Resource Cluster - x86 host.docker.internal
|
|
resource-cluster:
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
- "ollama-host:host-gateway"
|
|
environment:
|
|
ENVIRONMENT: production
|
|
DEBUG: "false"
|
|
|
|
# Tenant PostgreSQL Primary - x86 Performance Tuning
|
|
tenant-postgres-primary:
|
|
environment:
|
|
# x86_64 Performance settings - optimized for typical server specs
|
|
POSTGRES_SHARED_BUFFERS: 2GB
|
|
POSTGRES_EFFECTIVE_CACHE_SIZE: 6GB
|
|
POSTGRES_MAINTENANCE_WORK_MEM: 512MB
|
|
POSTGRES_MAX_CONNECTIONS: 300
|
|
POSTGRES_WORK_MEM: 128MB
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 8G
|
|
reservations:
|
|
memory: 4G
|
|
labels:
|
|
- "gt2.platform=x86_64"
|
|
|
|
# VLLM Embeddings Service - x86_64 Optimized
|
|
vllm-embeddings:
|
|
platform: linux/amd64
|
|
build:
|
|
context: .
|
|
dockerfile: .deployment/docker/Dockerfile.vllm-x86
|
|
environment:
|
|
- MODEL_NAME=BAAI/bge-m3
|
|
# x86_64 optimization - adjust based on your CPU
|
|
- OMP_NUM_THREADS=8
|
|
- MKL_NUM_THREADS=8
|
|
- PYTORCH_NUM_THREADS=8
|
|
- OPENBLAS_NUM_THREADS=8
|
|
# x86_64-specific optimizations
|
|
- GT2_PLATFORM=x86_64
|
|
- MALLOC_ARENA_MAX=4
|
|
- USE_ONNX_RUNTIME=true
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 16G
|
|
reservations:
|
|
memory: 8G
|
|
labels:
|
|
- "gt2.platform=x86_64"
|