Model/deploy/production/compose.single.yml at main · Michael-Yu2978/Model · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
name: modelport-production

# Phase-one production profile: one ModelPort instance, an external managed
# PostgreSQL database, and secret-manager-rendered runtime environment. This
# file deliberately has no PostgreSQL service and no repository .env mount.
services:
  modelport:
    image: ${MODELPORT_IMAGE:?set a digest-pinned ModelPort image}
    init: true
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m
    env_file:
      - path: ${MODELPORT_RUNTIME_ENV_FILE:?set a secret-manager-rendered runtime env file}
        required: true
    environment:
      MODELPORT_BIND: 0.0.0.0:38082
      MODELPORT_CONFIG: /config/config.toml
      MODELPORT_ENV_FILE: /run/modelport/no-repository-env
      MODELPORT_STATE_DIR: /data
      MODELPORT_ENTERPRISE_MODE: "1"
      MODELPORT_DATABASE_TLS_MODE: verify-full
      MODELPORT_REQUIRE_CONTROL_API_KEYS: "1"
      MODELPORT_ADMIN_COOKIE_SECURE: "1"
      MODELPORT_LOCAL_EXECUTING_PER_USER: "1"
      MODELPORT_LOCAL_QUEUED_PER_USER: "2"
      MODELPORT_LOCAL_QUEUE_GLOBAL: "16"
      MODELPORT_BATCH_QUEUE_GLOBAL: "16"
      MODELPORT_LOCAL_OVERFLOW_AFTER_SECONDS: "5"
      MODELPORT_LOCAL_STRICT_WAIT_SECONDS: "60"
      MODELPORT_FINALIZATION_DRAIN_TIMEOUT_SECONDS: "30"
      MODELPORT_REQUEST_DETAIL_RETENTION_DAYS: "30"
      MODELPORT_USER_USAGE_RETENTION_DAYS: "90"
      MODELPORT_AUDIT_RETENTION_DAYS: "395"
      MODELPORT_RETENTION_LEGAL_HOLD: ${MODELPORT_RETENTION_LEGAL_HOLD:-0}
    extra_hosts:
      - host.docker.internal:host-gateway
    ports:
      - ${MODELPORT_API_PUBLISH:-127.0.0.1:38082}:38082
    volumes:
      - modelport-data:/data
      - type: bind
        source: ${MODELPORT_CONFIG_FILE:?set the reviewed non-secret config.toml path}
        target: /config/config.toml
        read_only: true
      - type: bind
        source: ${MODELPORT_DATABASE_CA_FILE:?set the managed PostgreSQL CA file}
        target: /run/modelport/database-ca.pem
        read_only: true
    healthcheck:
      test:
        - CMD-SHELL
        - >-
          probe_key="$${MODELPORT_HEALTHCHECK_API_KEY:-}";
          test -n "$${probe_key}" &&
          curl -fsS -H "x-api-key: $${probe_key}" http://127.0.0.1:38082/readyz >/dev/null
      interval: 15s
      timeout: 5s
      start_period: 20s
      retries: 4
    restart: unless-stopped
    stop_grace_period: ${MODELPORT_STOP_GRACE_PERIOD:-11m}
    logging:
      driver: json-file
      options:
        max-size: ${MODELPORT_LOG_MAX_SIZE:-10m}
        max-file: "${MODELPORT_LOG_MAX_FILES:-5}"

  dashboard:
    image: ${MODELPORT_DASHBOARD_IMAGE:?set a digest-pinned dashboard image}
    init: true
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=32m
    ports:
      - ${MODELPORT_DASHBOARD_PUBLISH:-127.0.0.1:33002}:8080
    restart: unless-stopped
    stop_grace_period: ${MODELPORT_DASHBOARD_STOP_GRACE_PERIOD:-30s}
    logging:
      driver: json-file
      options:
        max-size: ${MODELPORT_LOG_MAX_SIZE:-10m}
        max-file: "${MODELPORT_LOG_MAX_FILES:-5}"

volumes:
  modelport-data:

networks:
  default:
    name: ${MODELPORT_NETWORK_NAME:-modelport_default}
    external: true