|
| 1 | +# MemOS with Krolik Security Extensions |
| 2 | +# |
| 3 | +# This Dockerfile builds MemOS with authentication, rate limiting, and admin API. |
| 4 | +# It uses the overlay pattern to keep customizations separate from base code. |
| 5 | + |
| 6 | +FROM python:3.11-slim |
| 7 | + |
| 8 | +# Install system dependencies |
| 9 | +RUN apt-get update && apt-get install -y --no-install-recommends \ |
| 10 | + gcc \ |
| 11 | + g++ \ |
| 12 | + build-essential \ |
| 13 | + libffi-dev \ |
| 14 | + python3-dev \ |
| 15 | + curl \ |
| 16 | + libpq-dev \ |
| 17 | + && rm -rf /var/lib/apt/lists/* |
| 18 | + |
| 19 | +# Create non-root user |
| 20 | +RUN groupadd -r memos && useradd -r -g memos -u 1000 memos |
| 21 | + |
| 22 | +WORKDIR /app |
| 23 | + |
| 24 | +# Use official Hugging Face |
| 25 | +ENV HF_ENDPOINT=https://huggingface.co |
| 26 | + |
| 27 | +# Copy base MemOS source |
| 28 | +COPY src/ ./src/ |
| 29 | +COPY pyproject.toml ./ |
| 30 | + |
| 31 | +# Install base dependencies |
| 32 | +RUN pip install --upgrade pip && \ |
| 33 | + pip install --no-cache-dir poetry && \ |
| 34 | + poetry config virtualenvs.create false && \ |
| 35 | + poetry install --no-dev --extras "tree-mem mem-scheduler" |
| 36 | + |
| 37 | +# Install additional dependencies for Krolik |
| 38 | +RUN pip install --no-cache-dir \ |
| 39 | + sentence-transformers \ |
| 40 | + torch \ |
| 41 | + transformers \ |
| 42 | + psycopg2-binary \ |
| 43 | + redis |
| 44 | + |
| 45 | +# Apply Krolik overlay (AFTER base install to allow easy updates) |
| 46 | +COPY overlays/krolik/ ./src/memos/ |
| 47 | + |
| 48 | +# Create data directory |
| 49 | +RUN mkdir -p /data/memos && chown -R memos:memos /data/memos |
| 50 | +RUN chown -R memos:memos /app |
| 51 | + |
| 52 | +# Set Python path |
| 53 | +ENV PYTHONPATH=/app/src |
| 54 | + |
| 55 | +# Switch to non-root user |
| 56 | +USER memos |
| 57 | + |
| 58 | +EXPOSE 8000 |
| 59 | + |
| 60 | +# Healthcheck |
| 61 | +HEALTHCHECK --interval=30s --timeout=10s --retries=3 --start-period=60s \ |
| 62 | + CMD curl -f http://localhost:8000/health || exit 1 |
| 63 | + |
| 64 | +# Use extended entry point with security features |
| 65 | +CMD ["gunicorn", "memos.api.server_api_ext:app", "--preload", "-w", "2", "-k", "uvicorn.workers.UvicornWorker", "--bind", "0.0.0.0:8000", "--timeout", "120"] |
0 commit comments