From 67eac35c683c1fdfdeef3da78f6d88e663805f66 Mon Sep 17 00:00:00 2001 From: Renn F Date: Wed, 24 Dec 2025 22:19:43 +0100 Subject: [PATCH] Moved on to DHI (Docker Hardened Images) --- docker-compose.yml | 9 +++- docker/agent-base.Dockerfile | 19 ++++---- docker/orchestrator.Dockerfile | 16 ++++--- docker/postgres-init/01-create-extensions.sql | 16 +++++++ docker/postgres-pgvector.Dockerfile | 44 +++++++++++++++++++ 5 files changed, 88 insertions(+), 16 deletions(-) create mode 100644 docker/postgres-init/01-create-extensions.sql create mode 100644 docker/postgres-pgvector.Dockerfile diff --git a/docker-compose.yml b/docker-compose.yml index a160d446..7ee4d62f 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,9 +1,13 @@ services: # ========================================================================== # PostgreSQL - Primary Database with pgvector for RAG + # Uses Docker Hardened Image (DHI) base with pgvector extension # ========================================================================== postgres: - image: pgvector/pgvector:pg16 + build: + context: . + dockerfile: docker/postgres-pgvector.Dockerfile + image: roboco-postgres-pgvector container_name: roboco-postgres restart: unless-stopped environment: @@ -22,9 +26,10 @@ services: # ========================================================================== # Redis - Cache, Sessions, Event Bus + # Uses Docker Hardened Image (DHI) for enhanced security # ========================================================================== redis: - image: redis:8-alpine + image: dhi.io/redis:8-alpine container_name: roboco-redis restart: unless-stopped command: redis-server --appendonly yes diff --git a/docker/agent-base.Dockerfile b/docker/agent-base.Dockerfile index b228c0da..7d023f75 100644 --- a/docker/agent-base.Dockerfile +++ b/docker/agent-base.Dockerfile @@ -1,17 +1,18 @@ -FROM debian:bookworm-slim +# ============================================================================= +# Agent Base Image - Docker Hardened Image (DHI) +# ============================================================================= +# Uses DHI Python 3.13 with dev tools for Claude Code agent containers +# ============================================================================= -# Install dependencies +FROM dhi.io/python:3.13-debian13-dev + +# Install Node.js 22 (required for Claude Code CLI) RUN apt-get update && apt-get install -y --no-install-recommends \ curl \ ca-certificates \ git \ - python3 \ - python3-pip \ - python3-venv \ - && rm -rf /var/lib/apt/lists/* - -# Install Node.js 22 -RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \ + gnupg \ + && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \ && apt-get install -y nodejs \ && rm -rf /var/lib/apt/lists/* diff --git a/docker/orchestrator.Dockerfile b/docker/orchestrator.Dockerfile index 0a550f25..1025b098 100644 --- a/docker/orchestrator.Dockerfile +++ b/docker/orchestrator.Dockerfile @@ -1,20 +1,26 @@ -FROM debian:bookworm-slim +# ============================================================================= +# Orchestrator - Docker Hardened Image (DHI) +# ============================================================================= +# API Server + Agent Spawner using DHI Python 3.13 +# ============================================================================= + +FROM dhi.io/python:3.13-debian13-dev # Install dependencies + Docker CLI RUN apt-get update && apt-get install -y --no-install-recommends \ curl \ ca-certificates \ git \ - python3 \ - python3-pip \ - python3-venv \ gnupg \ lsb-release \ && rm -rf /var/lib/apt/lists/* # Install Docker CLI (for spawning agent containers) +# Note: Using 'trixie' for Debian 13, fallback to bookworm if not available RUN curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg \ - && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/debian $(lsb_release -cs) stable" > /etc/apt/sources.list.d/docker.list \ + && DEBIAN_CODENAME=$(lsb_release -cs) \ + && if [ "$DEBIAN_CODENAME" = "trixie" ]; then DEBIAN_CODENAME="bookworm"; fi \ + && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/debian ${DEBIAN_CODENAME} stable" > /etc/apt/sources.list.d/docker.list \ && apt-get update \ && apt-get install -y docker-ce-cli \ && rm -rf /var/lib/apt/lists/* diff --git a/docker/postgres-init/01-create-extensions.sql b/docker/postgres-init/01-create-extensions.sql new file mode 100644 index 00000000..7d15da84 --- /dev/null +++ b/docker/postgres-init/01-create-extensions.sql @@ -0,0 +1,16 @@ +-- ============================================================================= +-- PostgreSQL Extensions Initialization +-- This script runs automatically on first database initialization +-- ============================================================================= + +-- pgvector: Vector similarity search for embeddings/RAG +CREATE EXTENSION IF NOT EXISTS vector; + +-- Verify extension is available +DO $$ +BEGIN + IF NOT EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'vector') THEN + RAISE EXCEPTION 'pgvector extension failed to install'; + END IF; + RAISE NOTICE 'pgvector extension installed successfully'; +END $$; diff --git a/docker/postgres-pgvector.Dockerfile b/docker/postgres-pgvector.Dockerfile new file mode 100644 index 00000000..0ec61349 --- /dev/null +++ b/docker/postgres-pgvector.Dockerfile @@ -0,0 +1,44 @@ +# ============================================================================= +# PostgreSQL with pgvector on Docker Hardened Image +# ============================================================================= +# Multi-stage build: +# 1. Build pgvector extension using standard postgres image (has build tools) +# 2. Copy compiled extension to DHI postgres (minimal, secure runtime) +# ============================================================================= + +# ----------------------------------------------------------------------------- +# Stage 1: Build pgvector extension +# ----------------------------------------------------------------------------- +FROM postgres:17 AS builder + +# Install build dependencies +RUN apt-get update && apt-get install -y --no-install-recommends \ + build-essential \ + git \ + postgresql-server-dev-17 \ + ca-certificates \ + && rm -rf /var/lib/apt/lists/* + +# Clone and build pgvector (use tagged release for reproducibility) +ARG PGVECTOR_VERSION=0.8.1 +RUN git clone --branch v${PGVECTOR_VERSION} --depth 1 https://github.com/pgvector/pgvector.git /tmp/pgvector \ + && cd /tmp/pgvector \ + && make OPTFLAGS="" \ + && make install + +# ----------------------------------------------------------------------------- +# Stage 2: DHI Runtime with pgvector +# ----------------------------------------------------------------------------- +FROM dhi.io/postgres:17-debian13 + +# Copy pgvector extension files from builder +# Extension shared library +COPY --from=builder /usr/lib/postgresql/17/lib/vector.so /usr/lib/postgresql/17/lib/ +# Extension control and SQL files +COPY --from=builder /usr/share/postgresql/17/extension/vector* /usr/share/postgresql/17/extension/ + +# Add init script to create extension on startup +COPY docker/postgres-init/01-create-extensions.sql /docker-entrypoint-initdb.d/ + +LABEL org.opencontainers.image.title="PostgreSQL with pgvector (DHI)" +LABEL org.opencontainers.image.description="Docker Hardened PostgreSQL 17 with pgvector extension for vector similarity search"