🐳 Yuxi

x-api-worker-env: &api-worker-env
  HOST_IP: ${HOST_IP:-}
  LITE_MODE: ${LITE_MODE:-}
  RUNNING_IN_DOCKER: "true"
  YUXI_ENV: production
  LANGGRAPH_CHECKPOINTER_BACKEND: ${LANGGRAPH_CHECKPOINTER_BACKEND:-postgres}
  PYTHONPATH: /app/package
  JWT_SECRET_KEY: ${JWT_SECRET_KEY:?Set JWT_SECRET_KEY in .env.prod}
  YUXI_INSTANCE_ID: ${YUXI_INSTANCE_ID:?Set YUXI_INSTANCE_ID in .env.prod}
  POSTGRES_URL: ${POSTGRES_URL:-postgresql+asyncpg://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env.prod}@postgres:5432/${POSTGRES_DB:-yuxi}}
  REDIS_URL: ${REDIS_URL:-redis://redis:6379/0}
  RUN_CANCEL_KEY_TTL_SECONDS: ${RUN_CANCEL_KEY_TTL_SECONDS:-1800}
  RUN_EVENTS_STREAM_TTL_SECONDS: ${RUN_EVENTS_STREAM_TTL_SECONDS:-7200}
  YUXI_CORS_ORIGINS: ${YUXI_CORS_ORIGINS:-}
  NEO4J_URI: ${NEO4J_URI:-bolt://graph:7687}
  NEO4J_USERNAME: ${NEO4J_USERNAME:-neo4j}
  NEO4J_PASSWORD: ${NEO4J_PASSWORD:?Set NEO4J_PASSWORD in .env.prod}
  MILVUS_URI: ${MILVUS_URI:-http://milvus:19530}
  MILVUS_DB_NAME: ${MILVUS_DB_NAME:-default}
  MILVUS_TOKEN: ${MILVUS_TOKEN:-}
  MINERU_API_URI: ${MINERU_API_URI:-http://mineru-api:30001}
  PADDLEX_URI: ${PADDLEX_URI:-http://paddlex:8080}
  MINIO_URI: ${MINIO_URI:-http://minio:9000}
  SANDBOX_PROVIDER: ${SANDBOX_PROVIDER:-provisioner}
  SANDBOX_PROVISIONER_URL: ${SANDBOX_PROVISIONER_URL:-http://sandbox-provisioner:8002}
  SANDBOX_PROVISIONER_TOKEN: ${SANDBOX_PROVISIONER_TOKEN:?Set SANDBOX_PROVISIONER_TOKEN in .env.prod}
  SANDBOX_VIRTUAL_PATH_PREFIX: ${SANDBOX_VIRTUAL_PATH_PREFIX:-/home/gem/user-data}
  SANDBOX_EXEC_TIMEOUT_SECONDS: ${SANDBOX_EXEC_TIMEOUT_SECONDS:-180}
  SANDBOX_MAX_OUTPUT_BYTES: ${SANDBOX_MAX_OUTPUT_BYTES:-262144}
  NO_PROXY: localhost,127.0.0.1,milvus,graph,minio,milvus-etcd,etcd,mineru,paddlex,sandbox-provisioner,api.siliconflow.cn
  no_proxy: localhost,127.0.0.1,milvus,graph,minio,milvus-etcd,etcd,mineru,paddlex,sandbox-provisioner,api.siliconflow.cn

services:
  api:
    build:
      context: .
      dockerfile: docker/api.Dockerfile
    image: yuxi-api:${YUXI_VERSION:-0.7.2.dev0}
    container_name: api-prod
    working_dir: /app
    networks:
      - app-network
    volumes:
      - ./docker/volumes/yuxi:/app/saves
      - ./docker/volumes/models:/app/models
    extra_hosts:
      - "host.docker.internal:host-gateway"
    env_file:
      - .env.prod
    # region api_envs
    environment:
      <<: *api-worker-env
    # endregion api_envs
    command: uv run --no-sync --no-dev uvicorn server.main:app --host 0.0.0.0 --port 5050
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:5050/api/system/health || exit 1"]
      interval: 30s
      timeout: 15s
      retries: 8
      start_period: 180s
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy
      sandbox-provisioner:
        condition: service_healthy

  worker:
    build:
      context: .
      dockerfile: docker/api.Dockerfile
    image: yuxi-api:${YUXI_VERSION:-0.7.2.dev0}
    container_name: worker-prod
    working_dir: /app
    networks:
      - app-network
    volumes:
      - ./docker/volumes/yuxi:/app/saves
      - ./docker/volumes/models:/app/models
    extra_hosts:
      - "host.docker.internal:host-gateway"
    env_file:
      - .env.prod
    environment:
      <<: *api-worker-env
    command: uv run --no-sync --no-dev arq server.worker_main.WorkerSettings
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy
      sandbox-provisioner:
        condition: service_healthy

  sandbox-provisioner:
    build:
      context: ./docker/sandbox_provisioner
      dockerfile: Dockerfile
    container_name: sandbox-provisioner
    volumes:
      - ./docker/volumes/yuxi:/app/saves
      - ./docker/sandbox_provisioner/sandbox.env:/app/sandbox.env:ro
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - app-network
    extra_hosts:
      - "host.docker.internal:host-gateway"
    environment:
      # Common provisioner settings
      - PROVISIONER_BACKEND=${SANDBOX_PROVISIONER_BACKEND:-docker}
      - PROVISIONER_PUBLIC_URL=${SANDBOX_PROVISIONER_URL:-http://sandbox-provisioner:8002}
      - SANDBOX_PROVISIONER_TOKEN=${SANDBOX_PROVISIONER_TOKEN:?Set SANDBOX_PROVISIONER_TOKEN in .env.prod}
      - SANDBOX_IMAGE=${SANDBOX_IMAGE:-enterprise-public-cn-beijing.cr.volces.com/vefaas-public/all-in-one-sandbox:latest}
      - SANDBOX_CONTAINER_PORT=${SANDBOX_CONTAINER_PORT:-8080}
      - MEMORY_SANDBOX_URL_TEMPLATE=${MEMORY_SANDBOX_URL_TEMPLATE:-http://agent-sandbox:8000}
      - SANDBOX_HEALTH_TIMEOUT_SECONDS=${SANDBOX_HEALTH_TIMEOUT_SECONDS:-300}
      - SANDBOX_IDLE_TIMEOUT_SECONDS=${SANDBOX_IDLE_TIMEOUT_SECONDS:-120}
      - SANDBOX_IDLE_CHECK_INTERVAL_SECONDS=${SANDBOX_IDLE_CHECK_INTERVAL_SECONDS:-10}
      - SANDBOX_EXEC_TIMEOUT_SECONDS=${SANDBOX_EXEC_TIMEOUT_SECONDS:-180}
      # Optional proxy for sandbox-provisioner container
      - HTTP_PROXY=${SANDBOX_HTTP_PROXY:-}
      - HTTPS_PROXY=${SANDBOX_HTTPS_PROXY:-}
      - NO_PROXY=localhost,127.0.0.1,host.docker.internal
      # Docker backend only
      - DOCKER_NETWORK_PREFIX=${SANDBOX_DOCKER_NETWORK_PREFIX:-yuxi-know-sandbox}
      - DOCKER_THREADS_HOST_PATH=${SANDBOX_DOCKER_THREADS_HOST_PATH:-}
      - DOCKER_SANDBOX_PREFIX=${SANDBOX_DOCKER_SANDBOX_PREFIX:-yuxi-sandbox}
      # Kubernetes backend only
      - K8S_NAMESPACE=${SANDBOX_K8S_NAMESPACE:-yuxi-know}
      - NODE_HOST=${SANDBOX_NODE_HOST:-host.docker.internal}
      - KUBECONFIG_PATH=${KUBECONFIG_PATH:-}
      - THREAD_PVC=${THREAD_PVC:-yuxi-thread}
      - SKILLS_PVC=${SKILLS_PVC:-yuxi-skills}
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8002/health').read()"]
      interval: 10s
      timeout: 5s
      retries: 6
      start_period: 10s
    restart: unless-stopped

  web:
    build:
      context: .
      dockerfile: docker/web.Dockerfile
      target: production
    image: yuxi-web:${YUXI_VERSION:-0.7.2.dev0}
    container_name: web-prod
    ports:
      - "80:80"
    depends_on:
      - api
    networks:
      - app-network
    environment:
      - NODE_ENV=production
      - VITE_LITE_MODE=${LITE_MODE:-}
    command: nginx -g "daemon off;"
    restart: unless-stopped

  graph:
    image: neo4j:5.26
    container_name: graph
    volumes:
      - ./docker/volumes/neo4j/data:/data
      - ./docker/volumes/neo4j/logs:/var/lib/neo4j/logs
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:7474 || exit 1"]
      interval: 20s
      timeout: 10s
      retries: 5
      start_period: 30s
    environment:
      - NEO4J_AUTH=${NEO4J_USERNAME:-neo4j}/${NEO4J_PASSWORD:?Set NEO4J_PASSWORD in .env.prod}
      - NEO4J_server_bolt_listen__address=0.0.0.0:7687
      - NEO4J_server_http_listen__address=0.0.0.0:7474
      - ENTITY_EMBEDDING=true
    networks:
      - app-network
    restart: unless-stopped

  etcd:
    container_name: milvus-etcd
    image: quay.io/coreos/etcd:v3.5.5
    environment:
      - ETCD_AUTO_COMPACTION_MODE=revision
      - ETCD_AUTO_COMPACTION_RETENTION=1000
      - ETCD_QUOTA_BACKEND_BYTES=4294967296
      - ETCD_SNAPSHOT_COUNT=50000
    volumes:
      - ./docker/volumes/milvus/etcd:/etcd
    command: etcd -advertise-client-urls=http://etcd:2379 -listen-client-urls http://0.0.0.0:2379 --data-dir /etcd
    healthcheck:
      test: ["CMD", "etcdctl", "endpoint", "health"]
      interval: 60s
      timeout: 30s
      retries: 5
      start_period: 30s
    networks:
      - app-network
    restart: unless-stopped

  minio:
    container_name: minio
    image: minio/minio:RELEASE.2023-03-20T20-16-18Z
    environment:
      MINIO_ACCESS_KEY: ${MINIO_ACCESS_KEY:?Set MINIO_ACCESS_KEY in .env.prod}
      MINIO_SECRET_KEY: ${MINIO_SECRET_KEY:?Set MINIO_SECRET_KEY in .env.prod}
    volumes:
      - ./docker/volumes/milvus/minio:/minio_data
      - ./docker/volumes/milvus/minio_config:/root/.minio
    command: minio server /minio_data --address 0.0.0.0:9000 --console-address 0.0.0.0:9001
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 60s
      timeout: 30s
      retries: 5
      start_period: 30s
    networks:
      - app-network
    restart: unless-stopped

  milvus:
    image: milvusdb/milvus:v2.5.6
    container_name: milvus
    command: ["milvus", "run", "standalone"]
    security_opt:
      - seccomp:unconfined
    environment:
      ETCD_ENDPOINTS: etcd:2379
      MINIO_ADDRESS: minio:9000
      MINIO_ACCESS_KEY_ID: ${MINIO_ACCESS_KEY:?Set MINIO_ACCESS_KEY in .env.prod}
      MINIO_SECRET_ACCESS_KEY: ${MINIO_SECRET_KEY:?Set MINIO_SECRET_KEY in .env.prod}
      MILVUS_LOG_LEVEL: error
    volumes:
      - ./docker/volumes/milvus/milvus:/var/lib/milvus
      - ./docker/volumes/milvus/logs:/var/lib/milvus/logs
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9091/healthz"]
      interval: 60s
      start_period: 120s
      timeout: 30s
      retries: 5
    depends_on:
      - "etcd"
      - "minio"
    networks:
      - app-network
    restart: unless-stopped

  postgres:
    image: postgres:16
    container_name: postgres
    environment:
      - POSTGRES_USER=${POSTGRES_USER:-postgres}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env.prod}
      - POSTGRES_DB=${POSTGRES_DB:-yuxi}
      - TZ=${TZ:-Asia/Shanghai}
    volumes:
      - ./docker/volumes/postgresql:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-yuxi} || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 30
    networks:
      - app-network
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    container_name: redis
    command: redis-server --appendonly yes
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 10
    volumes:
      - ./docker/volumes/redis:/data
    networks:
      - app-network
    restart: unless-stopped

  mineru-api:
    build:
      context: .
      dockerfile: docker/mineru.Dockerfile
    image: mineru-vllm:latest
    container_name: mineru-api
    profiles:
      - all
    env_file:
      - .env.prod
    environment:
      MINERU_MODEL_SOURCE: local
    entrypoint: mineru-api
    command:
      --host 0.0.0.0
      --port 30001
      # --allow-public-http-client  # Disabled by default; when binding to 0.0.0.0 or ::, this re-enables *-http-client backends and server_url. Enable only if you accept the SSRF risk.
      # parameters for vllm-engine
      # --gpu-memory-utilization 0.5  # If encountering VRAM shortage, reduce the KV cache size by this parameter; if VRAM issues persist, try lowering it further to `0.4` or below.
    ulimits:
      memlock: -1
      stack: 67108864
    ipc: host
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:30001/health || exit 1"]
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              device_ids: ["0"]  # Modify for multiple GPUs: ["0", "1"]
              capabilities: [gpu]
    networks:
      - app-network
    restart: unless-stopped

  paddlex:
    build:
      context: .
      dockerfile: docker/paddlex.Dockerfile
    image: paddlex:latest
    container_name: paddlex-ocr
    profiles:
      - all
    volumes:
      - ./docker/volumes/paddlex:/paddlex
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8080/health || exit 1"]
      interval: 20s
      timeout: 10s
      retries: 5
      start_period: 60s
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              device_ids: ['0']
              capabilities: [gpu]
    networks:
      - app-network
    restart: unless-stopped

networks:
  app-network:
    driver: bridge