1 line
15 KiB
JSON
1 line
15 KiB
JSON
{"repo": "cardan123/llmsec", "files": {"docker-compose.yml": {"591b17f089bff1c810eb845cb07a45f62767c87a": {"t": 1785747395.7952907, "n": 4969, "h": "5336eb4f7722ea09", "c": "# Dockerized app: gateway + Phoenix in containers.\n# - Target = DeepSeek cloud API (needs DEEPSEEK_API_KEY).\n# - Guardian = Granite Guardian, EITHER on the host (fast, Metal) OR in a container (slower,\n# CPU-only). Pick one:\n#\n# A) Guardian on the HOST (default — uses Metal/GPU, reached via host.docker.internal):\n# 1) bash scripts/serve_llama_guardian.sh 8081\n# 2) export DEEPSEEK_API_KEY=sk-...\n# 3) docker compose up -d --build\n# 4) docker compose --profile run run --rm runner --models fast --systems baseline,protected --limit 10\n# 5) open http://localhost:6006 (Phoenix)\n#\n# B) Guardian in a CONTAINER (no host llama-server needed):\n# 1) export DEEPSEEK_API_KEY=sk-...\n# 2) make docker-guardian # = LLMSEC_GUARDIAN_BASE_URL=http://guardian:8081/v1 \\\n# # docker compose --profile guardian up -d --build\n# 3) make docker-guardian-run # runs the eval through the containerized guardian\n# First start downloads the ~5 GB GGUF (cached in the guardian_models volume) and CPU\n# inference is slow; watch it warm up with: docker compose logs -f guardian\n\nservices:\n # Postgres backs Phoenix (traces) instead of the default SQLite.\n postgres:\n image: postgres:16\n restart: unless-stopped\n environment:\n POSTGRES_USER: phoenix\n POSTGRES_PASSWORD: phoenix\n POSTGRES_DB: phoenix\n volumes:\n - postgres_data:/var/lib/postgresql/data\n ports:\n - \"5432:5432\"\n healthcheck:\n test: [\"CMD-SHELL\", \"pg_isready -U phoenix\"]\n interval: 5s\n timeout: 3s\n retries: 10\n\n phoenix:\n image: arizephoenix/phoenix:latest\n restart: unless-stopped\n ports:\n - \"6006:6006\"\n environment:\n # Persist traces in Postgres (instead of ~/.phoenix/phoenix.db SQLite).\n PHOENIX_SQL_DATABASE_URL: postgresql://phoenix:phoenix@postgres:5432/phoenix\n depends_on:\n postgres:\n condition: service_healthy\n\n gateway:\n build: .\n image: llmsec-app:latest # shared by gateway + runner (one build covers both)\n restart: unless-stopped\n ports:\n - \"8000:8000\"\n environment:\n LLMSEC_CONFIG: config/examples/deepseek-granite.yaml\n LLMSEC_TARGET_API_KEY: ${DEEPSEEK_API_KEY:-}\n LLMSEC_GUARDIAN_BASE_URL: ${LLMSEC_GUARDIAN_BASE_URL:-http://host.docker.internal:8081/v1}\n LLMSEC_OTEL_ENDPOINT: http://phoenix:6006/v1/traces\n LLMSEC_LOG_LEVEL: ${LLMSEC_LOG_LEVEL:-INFO}\n extra_hosts:\n - \"host.docker.internal:host-gateway\" # reach the host Guardian (needed on Linux)\n volumes:\n - ./results:/app/results\n depends_on:\n - phoenix\n\n # One-shot runner: `docker compose run --rm runner --models fast --limit 10`\n # In the \"run\" profile so `docker compose up -d` does not trigger it.\n runner:\n build: .\n image: llmsec-app:latest # same image as gateway (rebuilt together)\n profiles: [\"run\"]\n environment:\n LLMSEC_CONFIG: config/examples/deepseek-granite.yaml\n LLMSEC_TARGET_API_KEY: ${DEEPSEEK_API_KEY:-}\n LLMSEC_GUARDIAN_BASE_URL: ${LLMSEC_GUARDIAN_BASE_URL:-http://host.docker.internal:8081/v1}\n LLMSEC_OTEL_ENDPOINT: http://phoenix:6006/v1/traces\n # The runner talks to the gateway container over the compose network.\n LLMSEC_GATEWAY_URL: http://gateway:8000/v1/chat/completions\n LLMSEC_LOG_LEVEL: ${LLMSEC_LOG_LEVEL:-INFO}\n extra_hosts:\n - \"host.docker.internal:host-gateway\"\n volumes:\n - ./results:/app/results\n - ./datasets:/app/datasets # so imported datasets (host) are visible in the container\n depends_on:\n - gateway\n entrypoint: [\"python\", \"-m\", \"llmsec.cli\", \"run\"]\n command: [\"--models\", \"fast\", \"--systems\", \"baseline,protected\", \"--limit\", \"10\"]\n\n # Granite Guardian INSIDE Docker (CPU-only — no Metal in a Mac container, so slower than the\n # host llama-server). The gateway/runner reach it over the compose network at guardian:8081.\n # The GGUF is downloaded on first start (~5 GB) and cached in the guardian_models volume.\n # Bring it up together with the gateway pointed at it:\n # LLMSEC_GUARDIAN_BASE_URL=http://guardian:8081/v1 docker compose --profile guardian up -d --build\n # (or simply: make docker-guardian)\n # Do NOT also run the host Guardian on :8081 at the same time — the published port collides.\n guardian:\n image: ghcr.io/ggml-org/llama.cpp:server\n profiles: [\"guardian\"]\n restart: unless-stopped\n ports:\n # Host-side port is configurable to avoid clashing with a host llama-server on 8081.\n # The gateway reaches the guardian over the compose network (guardian:8081) regardless.\n - \"${GUARDIAN_HOST_PORT:-8081}:8081\"\n environment:\n LLAMA_CACHE: /models # persist the -hf download here\n volumes:\n - guardian_models:/models\n command: >\n -hf ibm-granite/granite-guardian-4.1-8b-GGUF:Q4_K_M\n -c 4096 --host 0.0.0.0 --port 8081\n\nvolumes:\n postgres_data:\n guardian_models:\n"}, "c1b1ff8635438401c23a54ef12d5e958ba4fd6fa": {"t": 1785773046.858349, "n": 4969, "h": "5336eb4f7722ea09", "c": "# Dockerized app: gateway + Phoenix in containers.\n# - Target = DeepSeek cloud API (needs DEEPSEEK_API_KEY).\n# - Guardian = Granite Guardian, EITHER on the host (fast, Metal) OR in a container (slower,\n# CPU-only). Pick one:\n#\n# A) Guardian on the HOST (default — uses Metal/GPU, reached via host.docker.internal):\n# 1) bash scripts/serve_llama_guardian.sh 8081\n# 2) export DEEPSEEK_API_KEY=sk-...\n# 3) docker compose up -d --build\n# 4) docker compose --profile run run --rm runner --models fast --systems baseline,protected --limit 10\n# 5) open http://localhost:6006 (Phoenix)\n#\n# B) Guardian in a CONTAINER (no host llama-server needed):\n# 1) export DEEPSEEK_API_KEY=sk-...\n# 2) make docker-guardian # = LLMSEC_GUARDIAN_BASE_URL=http://guardian:8081/v1 \\\n# # docker compose --profile guardian up -d --build\n# 3) make docker-guardian-run # runs the eval through the containerized guardian\n# First start downloads the ~5 GB GGUF (cached in the guardian_models volume) and CPU\n# inference is slow; watch it warm up with: docker compose logs -f guardian\n\nservices:\n # Postgres backs Phoenix (traces) instead of the default SQLite.\n postgres:\n image: postgres:16\n restart: unless-stopped\n environment:\n POSTGRES_USER: phoenix\n POSTGRES_PASSWORD: phoenix\n POSTGRES_DB: phoenix\n volumes:\n - postgres_data:/var/lib/postgresql/data\n ports:\n - \"5432:5432\"\n healthcheck:\n test: [\"CMD-SHELL\", \"pg_isready -U phoenix\"]\n interval: 5s\n timeout: 3s\n retries: 10\n\n phoenix:\n image: arizephoenix/phoenix:latest\n restart: unless-stopped\n ports:\n - \"6006:6006\"\n environment:\n # Persist traces in Postgres (instead of ~/.phoenix/phoenix.db SQLite).\n PHOENIX_SQL_DATABASE_URL: postgresql://phoenix:phoenix@postgres:5432/phoenix\n depends_on:\n postgres:\n condition: service_healthy\n\n gateway:\n build: .\n image: llmsec-app:latest # shared by gateway + runner (one build covers both)\n restart: unless-stopped\n ports:\n - \"8000:8000\"\n environment:\n LLMSEC_CONFIG: config/examples/deepseek-granite.yaml\n LLMSEC_TARGET_API_KEY: ${DEEPSEEK_API_KEY:-}\n LLMSEC_GUARDIAN_BASE_URL: ${LLMSEC_GUARDIAN_BASE_URL:-http://host.docker.internal:8081/v1}\n LLMSEC_OTEL_ENDPOINT: http://phoenix:6006/v1/traces\n LLMSEC_LOG_LEVEL: ${LLMSEC_LOG_LEVEL:-INFO}\n extra_hosts:\n - \"host.docker.internal:host-gateway\" # reach the host Guardian (needed on Linux)\n volumes:\n - ./results:/app/results\n depends_on:\n - phoenix\n\n # One-shot runner: `docker compose run --rm runner --models fast --limit 10`\n # In the \"run\" profile so `docker compose up -d` does not trigger it.\n runner:\n build: .\n image: llmsec-app:latest # same image as gateway (rebuilt together)\n profiles: [\"run\"]\n environment:\n LLMSEC_CONFIG: config/examples/deepseek-granite.yaml\n LLMSEC_TARGET_API_KEY: ${DEEPSEEK_API_KEY:-}\n LLMSEC_GUARDIAN_BASE_URL: ${LLMSEC_GUARDIAN_BASE_URL:-http://host.docker.internal:8081/v1}\n LLMSEC_OTEL_ENDPOINT: http://phoenix:6006/v1/traces\n # The runner talks to the gateway container over the compose network.\n LLMSEC_GATEWAY_URL: http://gateway:8000/v1/chat/completions\n LLMSEC_LOG_LEVEL: ${LLMSEC_LOG_LEVEL:-INFO}\n extra_hosts:\n - \"host.docker.internal:host-gateway\"\n volumes:\n - ./results:/app/results\n - ./datasets:/app/datasets # so imported datasets (host) are visible in the container\n depends_on:\n - gateway\n entrypoint: [\"python\", \"-m\", \"llmsec.cli\", \"run\"]\n command: [\"--models\", \"fast\", \"--systems\", \"baseline,protected\", \"--limit\", \"10\"]\n\n # Granite Guardian INSIDE Docker (CPU-only — no Metal in a Mac container, so slower than the\n # host llama-server). The gateway/runner reach it over the compose network at guardian:8081.\n # The GGUF is downloaded on first start (~5 GB) and cached in the guardian_models volume.\n # Bring it up together with the gateway pointed at it:\n # LLMSEC_GUARDIAN_BASE_URL=http://guardian:8081/v1 docker compose --profile guardian up -d --build\n # (or simply: make docker-guardian)\n # Do NOT also run the host Guardian on :8081 at the same time — the published port collides.\n guardian:\n image: ghcr.io/ggml-org/llama.cpp:server\n profiles: [\"guardian\"]\n restart: unless-stopped\n ports:\n # Host-side port is configurable to avoid clashing with a host llama-server on 8081.\n # The gateway reaches the guardian over the compose network (guardian:8081) regardless.\n - \"${GUARDIAN_HOST_PORT:-8081}:8081\"\n environment:\n LLAMA_CACHE: /models # persist the -hf download here\n volumes:\n - guardian_models:/models\n command: >\n -hf ibm-granite/granite-guardian-4.1-8b-GGUF:Q4_K_M\n -c 4096 --host 0.0.0.0 --port 8081\n\nvolumes:\n postgres_data:\n guardian_models:\n"}, "5bae115649e5698f75c9181abadae4754cc6bbeb": {"t": 1785773048.138293, "n": 4949, "h": "f07b7b4fb73dcf04", "c": "# Dockerized app: gateway + Phoenix in containers.\n# - Target = DeepSeek cloud API (needs DEEPSEEK_API_KEY).\n# - Guardian = Granite Guardian, EITHER on the host (fast, Metal) OR in a container (slower,\n# CPU-only). Pick one:\n#\n# A) Guardian on the HOST (default — uses Metal/GPU, reached via host.docker.internal):\n# 1) bash scripts/serve_llama_guardian.sh 8081\n# 2) export DEEPSEEK_API_KEY=sk-...\n# 3) docker compose up -d --build\n# 4) docker compose --profile run run --rm runner --models fast --systems baseline,protected --limit 10\n# 5) open http://localhost:6006 (Phoenix)\n#\n# B) Guardian in a CONTAINER (no host llama-server needed):\n# 1) export DEEPSEEK_API_KEY=sk-...\n# 2) make docker-guardian # = LLMSEC_GUARDIAN_BASE_URL=http://guardian:8081/v1 \\\n# # docker compose --profile guardian up -d --build\n# 3) make docker-guardian-run # runs the eval through the containerized guardian\n# First start downloads the ~5 GB GGUF (cached in the guardian_models volume) and CPU\n# inference is slow; watch it warm up with: docker compose logs -f guardian\n\nservices:\n # Postgres backs Phoenix (traces) instead of the default SQLite.\n postgres:\n image: postgres:16\n restart: unless-stopped\n environment:\n POSTGRES_USER: phoenix\n POSTGRES_PASSWORD: phoenix\n POSTGRES_DB: phoenix\n volumes:\n - postgres_data:/var/lib/postgresql/data\n ports:\n - \"5432:5432\"\n healthcheck:\n test: [\"CMD-SHELL\", \"pg_isready -U phoenix\"]\n interval: 5s\n timeout: 3s\n retries: 10\n\n phoenix:\n image: arizephoenix/phoenix:latest\n restart: unless-stopped\n ports:\n - \"6006:6006\"\n environment:\n # Persist traces in Postgres (instead of ~/.phoenix/phoenix.db SQLite).\n PHOENIX_SQL_DATABASE_URL: postgresql://phoenix:phoenix@postgres:5432/phoenix\n depends_on:\n postgres:\n condition: service_healthy\n\n gateway:\n build: .\n image: llmsec-app:latest # shared by gateway + runner (one build covers both)\n restart: unless-stopped\n ports:\n - \"8000:8000\"\n environment:\n LLMSEC_CONFIG: config/config.deepseek.yaml\n LLMSEC_TARGET_API_KEY: ${DEEPSEEK_API_KEY:-}\n LLMSEC_GUARDIAN_BASE_URL: ${LLMSEC_GUARDIAN_BASE_URL:-http://host.docker.internal:8081/v1}\n LLMSEC_OTEL_ENDPOINT: http://phoenix:6006/v1/traces\n LLMSEC_LOG_LEVEL: ${LLMSEC_LOG_LEVEL:-INFO}\n extra_hosts:\n - \"host.docker.internal:host-gateway\" # reach the host Guardian (needed on Linux)\n volumes:\n - ./results:/app/results\n depends_on:\n - phoenix\n\n # One-shot runner: `docker compose run --rm runner --models fast --limit 10`\n # In the \"run\" profile so `docker compose up -d` does not trigger it.\n runner:\n build: .\n image: llmsec-app:latest # same image as gateway (rebuilt together)\n profiles: [\"run\"]\n environment:\n LLMSEC_CONFIG: config/config.deepseek.yaml\n LLMSEC_TARGET_API_KEY: ${DEEPSEEK_API_KEY:-}\n LLMSEC_GUARDIAN_BASE_URL: ${LLMSEC_GUARDIAN_BASE_URL:-http://host.docker.internal:8081/v1}\n LLMSEC_OTEL_ENDPOINT: http://phoenix:6006/v1/traces\n # The runner talks to the gateway container over the compose network.\n LLMSEC_GATEWAY_URL: http://gateway:8000/v1/chat/completions\n LLMSEC_LOG_LEVEL: ${LLMSEC_LOG_LEVEL:-INFO}\n extra_hosts:\n - \"host.docker.internal:host-gateway\"\n volumes:\n - ./results:/app/results\n - ./datasets:/app/datasets # so imported datasets (host) are visible in the container\n depends_on:\n - gateway\n entrypoint: [\"python\", \"-m\", \"llmsec.cli\", \"run\"]\n command: [\"--models\", \"fast\", \"--systems\", \"baseline,protected\", \"--limit\", \"10\"]\n\n # Granite Guardian INSIDE Docker (CPU-only — no Metal in a Mac container, so slower than the\n # host llama-server). The gateway/runner reach it over the compose network at guardian:8081.\n # The GGUF is downloaded on first start (~5 GB) and cached in the guardian_models volume.\n # Bring it up together with the gateway pointed at it:\n # LLMSEC_GUARDIAN_BASE_URL=http://guardian:8081/v1 docker compose --profile guardian up -d --build\n # (or simply: make docker-guardian)\n # Do NOT also run the host Guardian on :8081 at the same time — the published port collides.\n guardian:\n image: ghcr.io/ggml-org/llama.cpp:server\n profiles: [\"guardian\"]\n restart: unless-stopped\n ports:\n # Host-side port is configurable to avoid clashing with a host llama-server on 8081.\n # The gateway reaches the guardian over the compose network (guardian:8081) regardless.\n - \"${GUARDIAN_HOST_PORT:-8081}:8081\"\n environment:\n LLAMA_CACHE: /models # persist the -hf download here\n volumes:\n - guardian_models:/models\n command: >\n -hf ibm-granite/granite-guardian-4.1-8b-GGUF:Q4_K_M\n -c 4096 --host 0.0.0.0 --port 8081\n\nvolumes:\n postgres_data:\n guardian_models:\n"}}}} |