Moved on to DHI (Docker Hardened Images)

docker-compose.yml

@@ -1,9 +1,13 @@
 services:
   # ==========================================================================
   # PostgreSQL - Primary Database with pgvector for RAG
+  # Uses Docker Hardened Image (DHI) base with pgvector extension
   # ==========================================================================
   postgres:
-    image: pgvector/pgvector:pg16
+    build:
+      context: .
+      dockerfile: docker/postgres-pgvector.Dockerfile
+    image: roboco-postgres-pgvector
     container_name: roboco-postgres
     restart: unless-stopped
     environment:
@@ -22,9 +26,10 @@ services:
 
   # ==========================================================================
   # Redis - Cache, Sessions, Event Bus
+  # Uses Docker Hardened Image (DHI) for enhanced security
   # ==========================================================================
   redis:
-    image: redis:8-alpine
+    image: dhi.io/redis:8-alpine
     container_name: roboco-redis
     restart: unless-stopped
     command: redis-server --appendonly yes

docker/agent-base.Dockerfile

@@ -1,17 +1,18 @@
-FROM debian:bookworm-slim
+# =============================================================================
+# Agent Base Image - Docker Hardened Image (DHI)
+# =============================================================================
+# Uses DHI Python 3.13 with dev tools for Claude Code agent containers
+# =============================================================================
 
-# Install dependencies
+FROM dhi.io/python:3.13-debian13-dev
+
+# Install Node.js 22 (required for Claude Code CLI)
 RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     ca-certificates \
     git \
-    python3 \
-    python3-pip \
-    python3-venv \
-    && rm -rf /var/lib/apt/lists/*
-
-# Install Node.js 22
-RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+    gnupg \
+    && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && apt-get install -y nodejs \
     && rm -rf /var/lib/apt/lists/*
 

docker/orchestrator.Dockerfile

@@ -1,20 +1,26 @@
-FROM debian:bookworm-slim
+# =============================================================================
+# Orchestrator - Docker Hardened Image (DHI)
+# =============================================================================
+# API Server + Agent Spawner using DHI Python 3.13
+# =============================================================================
+
+FROM dhi.io/python:3.13-debian13-dev
 
 # Install dependencies + Docker CLI
 RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
     ca-certificates \
     git \
-    python3 \
-    python3-pip \
-    python3-venv \
     gnupg \
     lsb-release \
     && rm -rf /var/lib/apt/lists/*
 
 # Install Docker CLI (for spawning agent containers)
+# Note: Using 'trixie' for Debian 13, fallback to bookworm if not available
 RUN curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg \
-    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/debian $(lsb_release -cs) stable" > /etc/apt/sources.list.d/docker.list \
+    && DEBIAN_CODENAME=$(lsb_release -cs) \
+    && if [ "$DEBIAN_CODENAME" = "trixie" ]; then DEBIAN_CODENAME="bookworm"; fi \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/debian ${DEBIAN_CODENAME} stable" > /etc/apt/sources.list.d/docker.list \
     && apt-get update \
     && apt-get install -y docker-ce-cli \
     && rm -rf /var/lib/apt/lists/*

docker/postgres-init/01-create-extensions.sql

@@ -0,0 +1,16 @@
+-- =============================================================================
+-- PostgreSQL Extensions Initialization
+-- This script runs automatically on first database initialization
+-- =============================================================================
+
+-- pgvector: Vector similarity search for embeddings/RAG
+CREATE EXTENSION IF NOT EXISTS vector;
+
+-- Verify extension is available
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'vector') THEN
+        RAISE EXCEPTION 'pgvector extension failed to install';
+    END IF;
+    RAISE NOTICE 'pgvector extension installed successfully';
+END $$;

docker/postgres-pgvector.Dockerfile

@@ -0,0 +1,44 @@
+# =============================================================================
+# PostgreSQL with pgvector on Docker Hardened Image
+# =============================================================================
+# Multi-stage build:
+#   1. Build pgvector extension using standard postgres image (has build tools)
+#   2. Copy compiled extension to DHI postgres (minimal, secure runtime)
+# =============================================================================
+
+# -----------------------------------------------------------------------------
+# Stage 1: Build pgvector extension
+# -----------------------------------------------------------------------------
+FROM postgres:17 AS builder
+
+# Install build dependencies
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    git \
+    postgresql-server-dev-17 \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Clone and build pgvector (use tagged release for reproducibility)
+ARG PGVECTOR_VERSION=0.8.1
+RUN git clone --branch v${PGVECTOR_VERSION} --depth 1 https://github.com/pgvector/pgvector.git /tmp/pgvector \
+    && cd /tmp/pgvector \
+    && make OPTFLAGS="" \
+    && make install
+
+# -----------------------------------------------------------------------------
+# Stage 2: DHI Runtime with pgvector
+# -----------------------------------------------------------------------------
+FROM dhi.io/postgres:17-debian13
+
+# Copy pgvector extension files from builder
+# Extension shared library
+COPY --from=builder /usr/lib/postgresql/17/lib/vector.so /usr/lib/postgresql/17/lib/
+# Extension control and SQL files
+COPY --from=builder /usr/share/postgresql/17/extension/vector* /usr/share/postgresql/17/extension/
+
+# Add init script to create extension on startup
+COPY docker/postgres-init/01-create-extensions.sql /docker-entrypoint-initdb.d/
+
+LABEL org.opencontainers.image.title="PostgreSQL with pgvector (DHI)"
+LABEL org.opencontainers.image.description="Docker Hardened PostgreSQL 17 with pgvector extension for vector similarity search"