Docker容器化：环境隔离与可重复构建

# 基础镜像层
FROM ubuntu:22.04

# 依赖安装层
RUN apt-get update && apt-get install -y \
    python3.11 \
    python3-pip \
    nodejs \
    npm

# 应用代码层
COPY ./app /app

# 配置层
COPY ./config /config

# 入口点层
CMD ["python3", "/app/main.py"]

$ docker history ubuntu:22.04-python-aiide
IMAGE          CREATED         CREATED BY                                      SIZE      COMMENT
a1b2c3d4e5f6   5 seconds ago   CMD ["/bin/bash"]                              0B        buildkit.dockerfile.v0
<fake>         5 seconds ago   EXPOSE map[80/tcp 443/tcp]                     0B        buildkit.dockerfile.v0
<fake>         5 seconds ago   ENV PYTHONUNBUFFERED=1                          0B        buildkit.dockerfile.v0
<fake>         15 seconds ago  RUN apt-get update && apt-get install...        856MB     buildkit.dockerfile.v0
<fake>         2 weeks ago     /bin/sh -c #(nop)  ADD file:43cde77a... in /   77.8MB    buildkit.dockerfile.v0
<fake>         2 weeks ago     /bin/sh -c #(nop)  LABEL org.opencontainers...  0B        buildkit.dockerfile.v0

docker volume create aiide-workspace
docker run -v aiide-workspace:/workspace my-aiide-image

docker run -v /host/path:/container/path my-aiide-image

docker run --tmpfs /tmp my-aiide-image

# docker-compose.yml
version: '3.8'
services:
  ai-ide-backend:
    image: aiide/backend:1.0.0
    volumes:
      # 代码工作区持久化
      - aiide-code:/app/workspace
      # 模型文件共享
      - model-cache:/root/.cache
      # 配置文件
      - ./config:/app/config:ro
    tmpfs:
      # 临时文件存储在内存
      - /tmp/agent-execution

volumes:
  aiide-code:
    driver: local
  model-cache:
    driver: local

# 创建自定义bridge网络
docker network create --driver bridge --subnet 172.20.0.0/16 aiide-network

# 连接容器到网络
docker network connect aiide-network container-name

# 查看网络详情
docker network inspect aiide-network

# 不推荐：直接使用官方Python镜像
FROM python:3.11

# 推荐：基于ubuntu自定义Python环境
FROM ubuntu:22.04

# 安装特定版本的Python（通过pyenv管理）
RUN apt-get update && apt-get install -y \
    build-essential \
    libssl-dev \
    zlib1g-dev \
    libbz2-dev \
    libreadline-dev \
    libsqlite3-dev \
    curl \
    git \
    && curl https://pyenv.run | bash

ENV PYENV_ROOT=/root/.pyenv
ENV PATH=$PYENV_ROOT/shims:$PYENV_ROOT/bin:$PATH
RUN pyenv install 3.11.7 && pyenv global 3.11.7

# Stage 1: 依赖安装层（频繁变化较少）
FROM ubuntu:22.04 AS deps

RUN apt-get update && apt-get install -y \
    python3.11 \
    python3-pip \
    && rm -rf /var/lib/apt/lists/*

# 先复制依赖文件，利用缓存
COPY requirements.txt /tmp/
RUN pip install --prefix=/deps -r /tmp/requirements.txt

# Stage 2: 工具链层
FROM ubuntu:22.04 AS builder

RUN apt-get update && apt-get install -y \
    build-essential \
    git \
    nodejs \
    npm

# Stage 3: 应用层
FROM ubuntu:22.04 AS runtime

# 从builder复制编译好的工具
COPY --from=builder /usr/local/bin /usr/local/bin
COPY --from=deps /deps /usr/local

# 复制应用代码（变化最频繁，放最后）
COPY ./src /app
COPY ./config /app/config

WORKDIR /app
ENV PYTHONPATH=/app
CMD ["python", "main.py"]

# docker-bake.hcl
variable "IMAGE_NAME" {
  default = "aiide/backend"
}

group "default" {
  targets = ["linux/amd64", "linux/arm64"]
}

target "linux/amd64" {
  dockerfile = "Dockerfile"
  platforms = ["linux/amd64"]
  tags = ["${IMAGE_NAME}:latest"]
}

target "linux/arm64" {
  dockerfile = "Dockerfile"
  platforms = ["linux/arm64"]
  tags = ["${IMAGE_NAME}:latest"]
}

target "linux/amd64" {
  dockerfile = "Dockerfile"
  platforms = ["linux/amd64"]
  tags = ["${IMAGE_NAME}:1.0.0"]
}

target "linux/arm64" {
  dockerfile = "Dockerfile"
  platforms = ["linux/arm64"]
  tags = ["${IMAGE_NAME}:1.0.0"]
}

docker buildx create --use
docker buildx build --platform linux/amd64,linux/arm64 -t aiide/backend:1.0.0 --push .

# 基于NVIDIA CUDA的AI IDE镜像
FROM nvidia/cuda:12.1.0-runtime-ubuntu22.04

ENV DEBIAN_FRONTEND=noninteractive
ENV PYTHONUNBUFFERED=1
ENV CUDA_HOME=/usr/local/cuda

# 安装基础依赖
RUN apt-get update && apt-get install -y \
    python3.11 \
    python3-pip \
    git \
    curl \
    vim \
    && rm -rf /var/lib/apt/lists/*

# 安装PyTorch（GPU版本）
RUN pip install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu121

# 安装Transformers和LLM相关库
RUN pip install \
    transformers \
    accelerate \
    sentencepiece \
    protobuf

WORKDIR /workspace
COPY ./app /workspace/app

CMD ["python", "/workspace/app/main.py"]

# 查看容器默认Capabilities
docker run --rm ubuntu:22.04 cat /proc/self/status | grep Cap
CapInh: 0000000000000000
CapEff: 00000000a80425db  # 十六进制表示
CapBnd: 00000000a80425db
CapAmb: 0000000000000000

# docker-compose.yml - AI IDE安全配置
services:
  ai-ide-agent:
    image: aiide/agent-runtime:1.0.0
    security_opt:
      # 使用默认seccomp配置文件
      seccomp: unconfined
    cap_add:
      - NET_BIND_SERVICE
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
      - /run

{
  "defaultAction": "SCMP_ACT_ERRNO",
  "syscalls": [
    {
      "names": [
        "ioctl",
        "execve",
        "clone",
        "fork",
        "vfork",
        "kill"
      ],
      "action": "SCMP_ACT_ALLOW"
    },
    {
      "names": [
        "mount",
        "umount2",
        "pivot_root",
        "quotactl"
      ],
      "action": "SCMP_ACT_ERRNO",
      "errnoRet": 1,
      "comment": "Prevent container breakout"
    }
  ]
}

# aiide-seccomp.json
{
  "defaultAction": "SCMP_ACT_LOG",
  "syscalls": [
    {
      "names": [
        "read",
        "write",
        "open",
        "close",
        "pipe",
        "select",
        "poll",
        "readv",
        "writev",
        "recvfrom",
        "sendto",
        "recvmsg",
        "sendmsg",
        "shutdown",
        "socket",
        "connect",
        "accept",
        "getsockname",
        "getpeername",
        "socketpair",
        "bind",
        "listen",
        "getsockopt",
        "setsockopt"
      ],
      "action": "SCMP_ACT_ALLOW"
    },
    {
      "names": [
        "brk",
        "mmap",
        "mprotect",
        "munmap",
        "madvise"
      ],
      "action": "SCMP_ACT_ALLOW"
    },
    {
      "names": [
        "arch_prctl",
        "modify_ldt"
      ],
      "action": "SCMP_ACT_ALLOW"
    },
    {
      "names": [
        "clone",
        "vfork",
        "exit_group"
      ],
      "action": "SCMP_ACT_ALLOW"
    },
    {
      "names": [
        "unshare",
        "setns"
      ],
      "action": "SCMP_ACT_ERRNO",
      "errnoRet": 1,
      "comment": "Prevent namespace manipulation"
    }
  ]
}

docker run --security-opt seccomp=./aiide-seccomp.json aiide/agent-runtime:1.0.0

# 查看容器的AppArmor状态
docker inspect --format '{{ .AppArmorProfile }}' container-id
unconfined

# 使用自定义AppArmor配置文件
docker run --security-opt "apparmor=docker-aiide" aiide/agent-runtime:1.0.0

# /etc/apparmor.d/docker-aiide
profile docker-aiide {
  # 基础执行权限
  capability setuid,
  capability setgid,
  capability net_bind_service,
  
  # 文件系统访问控制
  /app/** r,
  /app/bin/** rx,
  /config/** r,
  /workspace/** rw,
  /tmp/** rw,
  
  # 网络访问
  network inet stream,
  network inet dgram,
  
  # 禁止exec
  deny /usr/bin/ptrace Ux,
  deny /proc/*/mem r,
}

# /etc/docker/daemon.json
{
  "userns-remap": "aiide-user"
}

# /etc/subuid
aiide-user:100000:65536

# /etc/subgid
aiide-user:100000:65536

# docker-compose.sandbox.yml
services:
  sandbox-agent:
    image: aiide/sandbox-runtime:1.0.0
    security_opt:
      seccomp: ./profiles/restrictive-seccomp.json
      apparmor: docker-sandbox
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m
      - /sandbox:rw,noexec,nosuid,size=512m
    limits:
      memory: 512m
      pids: 100
    network_mode: "none"

# 安装Docker Scout CLI
docker scout install

# 分析镜像漏洞
docker scout cves aiide/backend:1.0.0

# 生成安全报告
docker scout report --format html --output security-report.html aiide/backend:1.0.0

# 硬限制：容器最大使用512MB内存
docker run -m 512m aiide/backend:1.0.0

# 软限制：容器可以申请512MB，但可根据情况使用更多（如果可用）
docker run --memory-reservation 256m aiide/backend:1.0.0

# 组合：硬限制512MB，软限制256MB
docker run -m 512m --memory-reservation 256m aiide/backend:1.0.0

# 交换空间限制：允许使用2倍于内存的交换空间
docker run -m 512m --memory-swap 1g aiide/backend:1.0.0

# 限制容器最多使用2个CPU核心
docker run --cpus 2 aiide/backend:1.0.0

# 限制容器使用特定CPU核心（核心0和1）
docker run --cpuset-cpus 0,1 aiide/backend:1.0.0

# 限制CPU配额（100% = 100000）
# 0.5个CPU = 50000
docker run --cpu-quota 50000 aiide/backend:1.0.0

# CPU分享权重（相对值，默认1024）
docker run --cpu-shares 1024 aiide/backend:1.0.0

# 限制每秒读IOPS为100，写IOPS为50
docker run \
  --device-read-bps /dev/sda:1mb \
  --device-write-bps /dev/sda:512kb \
  aiide/backend:1.0.0

# 限制IO权重（权重范围10-1000）
docker run --blkio-weight 500 aiide/backend:1.0.0

# 细粒度IO限制
docker run \
  --blkio-weight-device /dev/sda:200 \
  --device-read-iops /dev/sda:100 \
  --device-write-iops /dev/sda:50 \
  aiide/backend:1.0.0

# 限制最多100个进程
docker run --pids-limit 100 aiide/backend:1.0.0

# 限制入站带宽
docker run --ingress-port 8080 --limit 100mbit aiide/backend:1.0.0

# docker-compose.prod.yml
version: '3.8'

services:
  # 代码执行引擎 - 资源受限
  code-executor:
    image: aiide/code-executor:1.0.0
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 1G
          pids: 50
        reservations:
          cpus: '0.5'
          memory: 256M
    mem_limit: 1g
    mem_reservation: 256m
    cpu_count: 2
    cpu_percent: 50

  # LLM推理服务 - 内存密集
  llm-inference:
    image: aiide/llm-inference:1.0.0
    deploy:
      resources:
        limits:
          cpus: '4.0'
          memory: 8G
        reservations:
          cpus: '1.0'
          memory: 4G
    environment:
      CUDA_VISIBLE_DEVICES: "0"
    volumes:
      - model-cache:/root/.cache

  # Redis缓存 - 内存优化
  redis-cache:
    image: redis:7-alpine
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 128M
    command: redis-server --maxmemory 256mb --maxmemory-policy allkeys-lru

  # PostgreSQL数据库
  postgres:
    image: postgres:15-alpine
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M
    environment:
      POSTGRES_MAX_CONNECTIONS: "100"
    volumes:
      - postgres-data:/var/lib/postgresql/data

volumes:
  model-cache:
  postgres-data:

# 实时监控所有容器资源使用
docker stats

# 输出格式
# CONTAINER ID   NAME              CPU %   MEM USAGE / LIMIT     MEM %   NET I/O           BLOCK I/O
# a1b2c3d4e5f6   aiide-backend-1   2.45%   512MiB / 1GiB         50.00%  1.23MB / 567KB    12.3MB / 4.56MB

# 监控特定容器
docker stats aiide-backend-1 --format "table {{.Container}}\t{{.CPUPerc}}\t{{.MemUsage}}"

# 导出统计数据到JSON
docker stats --no-stream --format "{{json .}}" > stats.json

# docker-compose.monitoring.yml
services:
  prometheus:
    image: prom/prometheus:latest
    ports:
      - "9090:9090"
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'

  grafana:
    image: grafana/grafana:latest
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin
    volumes:
      - grafana-data:/var/lib/grafana

volumes:
  grafana-data:

# prometheus.yml
global:
  scrape_interval: 15s

scrape_configs:
  - job_name: 'docker'
    static_configs:
      - targets: ['host.docker.internal:9323']

# 反模式：每次代码修改都会使apt缓存失效
FROM ubuntu:22.04
COPY ./app /app  # 代码变化频繁
RUN apt-get update && apt-get install -y python3.11 git  # 依赖稳定但被代码变化拖累

# 正模式：依赖层优先，代码层在后
FROM ubuntu:22.04
RUN apt-get update && apt-get install -y python3.11 git  # 稳定层，缓存命中率高
COPY ./requirements.txt /tmp/requirements.txt
RUN pip install -r /tmp/requirements.txt
COPY ./app /app  # 变化层放最后

# Stage 1: 构建阶段
FROM python:3.11-slim AS builder

WORKDIR /app

# 安装构建依赖
RUN apt-get update && apt-get install -y \
    build-essential \
    libpq-dev \
    && rm -rf /var/lib/apt/lists/*

# 安装Python依赖
COPY requirements.txt .
RUN pip install --prefix=/install -r requirements.txt

# Stage 2: 运行环境
FROM python:3.11-slim

# 安全加固：创建非root用户
RUN groupadd -r aiide && useradd -r -g aiide aiide

# 只复制需要的文件
COPY --from=builder /install /usr/local
COPY --from=builder /app /app

WORKDIR /app
USER aiide

ENV PYTHONUNBUFFERED=1
ENV PYTHONDONTWRITEBYTECODE=1

CMD ["python", "main.py"]

# 合并RUN指令减少层数
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        python3.11 \
        python3-pip \
        git \
        curl \
        vim \
        wget \
    && apt-get clean \
    && rm -rf /var/lib/apt/lists/* \
    && find /var/cache/debconf -name '*.dat' -delete

# 使用 --no-install-recommends 避免安装非必要依赖
RUN apt-get install -y --no-install-recommends package-name

# 清理所有缓存
RUN pip install --no-cache-dir package-name

# 安装dive
curl -sL https://github.com/wagoodman/dive/releases/download/v0.10.0/dive_0.10.0_linux_amd64.tar.gz | tar -xz
sudo mv dive /usr/local/bin

# 分析镜像
dive aiide/backend:1.0.0

#!/bin/bash
# analyze-image.sh - 分析镜像体积分布

IMAGE=$1
echo "=== 镜像: $IMAGE ==="

echo -e "\n--- 各层大小 ---"
docker history "$IMAGE" --format "{{.Size}}\t{{.CreatedBy}}" | \
    awk '{sum+=$1; if($1 ~ /^[0-9.]+[KMG]B$/) print}' | \
    sort -rh | head -20

echo -e "\n--- 总大小 ---"
docker image inspect "$IMAGE" --format='{{.Size}}'

echo -e "\n--- 可压缩建议 ---"
echo "1. 检查是否有不必要的apt缓存"
echo "2. 确认是否使用了多阶段构建"
echo "3. 验证--no-install-recommends标志"

# 启用BuildKit
export DOCKER_BUILDKIT=1

# 并行构建依赖
docker build -t aiide/backend:1.0.0 .

# Dockerfile - 使用BuildKit heredoc
FROM ubuntu:22.04

RUN <<EOF
apt-get update
apt-get install -y python3.11 git curl
apt-get clean
rm -rf /var/lib/apt/lists/*
EOF

# 利用构建缓存持久化pip下载
FROM python:3.11-slim

RUN --mount=type=cache,target=/root/.cache/pip \
    pip install torch transformers numpy

# ============================================
# AI IDE Backend Dockerfile - 最佳实践版本
# ============================================

# ============ Stage 1: 依赖构建 ============
FROM python:3.11-slim AS deps

# 安装系统依赖
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        build-essential \
        libpq-dev \
        libffi-dev \
        libssl-dev \
    && rm -rf /var/lib/apt/lists/*

# 分离依赖安装层
COPY requirements.txt /tmp/
RUN pip install --prefix=/install --no-cache-dir -r /tmp/requirements.txt

# ============ Stage 2: 应用构建 ============
FROM python:3.11-slim AS builder

WORKDIR /app

# 复制依赖
COPY --from=deps /install /usr/local

# 复制应用代码
COPY ./src ./src
COPY ./config ./config
COPY pyproject.toml ./

# 构建应用（如果有C扩展）
RUN pip install --no-cache-dir -e .

# ============ Stage 3: 运行时 ============
FROM python:3.11-slim AS runtime

# 安全：非root用户
RUN groupadd -r aiide && \
    useradd -r -g aiide -d /app -s /sbin/nologin aiide && \
    mkdir /app && chown aiide:aiide /app

# 安装运行时依赖
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        libpq5 \
        libffi7 \
        tini \
    && rm -rf /var/lib/apt/lists/*

# 复制构建产物
COPY --from=builder --chown=aiide:aiide /app /app
COPY --from=builder --chown=aiide:aiide /usr/local /usr/local

WORKDIR /app
USER aiide

# 优雅停止
ENTRYPOINT ["/usr/bin/tini", "--"]

ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONPATH=/app

# 健康检查
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD python -c "import requests; requests.get('http://localhost:8000/health')"

EXPOSE 8000

CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

# code-executor/Dockerfile
FROM python:3.11-slim

LABEL maintainer="aiide-team"
LABEL service="code-executor"

# 安装系统依赖
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        # 代码执行必需
        python3.11 \
        python3-pip \
        nodejs \
        npm \
        # 工具链
        git \
        curl \
        wget \
        vim \
        # 进程管理
        tini \
        # 安全工具
        gosu \
        # 编译环境（某些Python包需要）
        build-essential \
        libffi-dev \
    && rm -rf /var/lib/apt/lists/*

# 配置npm
RUN npm config set unsafe-perm true \
    && npm config set prefix /usr/local

# 创建工作目录和用户
RUN mkdir -p /workspace /tmp/execution && \
    groupadd -r aiide && \
    useradd -r -g aiide -d /workspace -s /bin/bash aiide && \
    chown -R aiide:aiide /workspace /tmp/execution

# 复制应用代码
COPY ./src /app
COPY ./config /app/config
COPY ./scripts /app/scripts

# 安装Python依赖
COPY requirements.txt /tmp/
RUN pip install --no-cache-dir -r /tmp/requirements.txt

# 设置环境变量
ENV LANG=C.UTF-8 \
    LC_ALL=C.UTF-8 \
    PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    EXECUTION_TIMEOUT=300

WORKDIR /workspace
USER aiide

# 入口点
ENTRYPOINT ["/usr/bin/tini", "--"]
CMD ["python", "/app/main.py"]

# llm-inference/Dockerfile
FROM nvidia/cuda:12.1.0-runtime-ubuntu22.04

LABEL maintainer="aiide-team"
LABEL service="llm-inference"

ENV DEBIAN_FRONTEND=noninteractive
ENV PYTHONUNBUFFERED=1

# 安装基础依赖
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        python3.11 \
        python3-pip \
        git \
        curl \
        wget \
        libgomp1 \
        libgl1-mesa-glx \
        libglib2.0-0 \
    && rm -rf /var/lib/apt/lists/*

# 创建用户
RUN groupadd -r aiide && \
    useradd -r -g aiide -d /workspace -s /bin/bash aiide

WORKDIR /workspace

# 安装PyTorch (CUDA 12.1)
RUN pip install --no-cache-dir \
    torch==2.1.0 \
    torchvision==0.16.0 \
    torchaudio==2.1.0 \
    --index-url https://download.pytorch.org/whl/cu121

# 安装Transformers和推理相关库
RUN pip install --no-cache-dir \
    transformers==4.35.0 \
    accelerate==0.24.0 \
    sentencepiece==0.1.99 \
    protobuf==3.20.3 \
    bitsandbytes==0.41.1 \
    auto-gptq==0.4.2 \
    vllm==0.2.0

# 复制应用代码
COPY ./src /app
COPY ./config /app/config

# 预热模型缓存目录
RUN mkdir -p /root/.cache/huggingface && \
    chown -R aiide:aiide /root/.cache

# 复制模型缓存（如果有）
COPY ./models /root/.cache/huggingface/models

WORKDIR /app
USER aiide

ENV TRANSFORMERS_CACHE=/root/.cache/huggingface \
    HF_HOME=/root/.cache/huggingface \
    CUDA_VISIBLE_DEVICES=0

EXPOSE 8000

CMD ["python", "/app/main.py"]

# file-service/Dockerfile
FROM python:3.11-slim

LABEL maintainer="aiide-team"
LABEL service="file-service"

# 安装依赖
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        python3.11 \
        python3-pip \
        libmagic1 \
        antiword \
        poppler-utils \
        tesseract-ocr \
        unoconv \
        inkscape \
        ffmpeg \
    && rm -rf /var/lib/apt/lists/*

# 创建工作目录
RUN mkdir -p /uploads /processed /cache && \
    groupadd -r aiide && \
    useradd -r -g aiide -d /uploads -s /bin/bash aiide && \
    chown -R aiide:aiide /uploads /processed /cache

# 安装Python依赖
COPY requirements.txt /tmp/
RUN pip install --no-cache-dir -r /tmp/requirements.txt

# 复制应用代码
COPY ./src /app
COPY ./config /app/config

WORKDIR /app
USER aiide

ENV PYTHONUNBUFFERED=1 \
    MAX_FILE_SIZE=104857600  # 100MB

EXPOSE 8000

CMD ["python", "/app/main.py"]

# docker-compose.yml - AI IDE后端服务完整编排
version: '3.8'

services:
  # ============ 网关层 ============
  nginx:
    image: nginx:1.25-alpine
    container_name: aiide-nginx
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
      - nginx-logs:/var/log/nginx
    depends_on:
      - auth-service
      - code-executor
      - llm-inference
      - file-service
      - task-scheduler
    networks:
      - aiide-network
    restart: unless-stopped

  # ============ 认证服务 ============
  auth-service:
    build:
      context: ./services/auth-service
      dockerfile: Dockerfile
      target: runtime
    container_name: aiide-auth
    environment:
      - DATABASE_URL=postgresql://aiide:${DB_PASSWORD}@postgres:5432/aiide_auth
      - REDIS_URL=redis://redis:6379/0
      - JWT_SECRET=${JWT_SECRET}
      - JWT_ALGORITHM=HS256
      - ACCESS_TOKEN_EXPIRE_MINUTES=30
      - REFRESH_TOKEN_EXPIRE_DAYS=7
    volumes:
      - ./services/auth-service/config:/app/config:ro
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
    networks:
      - aiide-network
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 128M
    restart: unless-stopped

  # ============ 代码执行服务 ============
  code-executor:
    build:
      context: ./services/code-executor
      dockerfile: Dockerfile
      target: runtime
    container_name: aiide-code-executor
    environment:
      - REDIS_URL=redis://redis:6379/1
      - EXECUTION_TIMEOUT=300
      - MAX_CONCURRENT_EXECUTIONS=10
      - ALLOWED_LANGUAGES=python,javascript,typescript,go,rust
      - SANDBOX_MODE=true
    volumes:
      - code-workspace:/workspace
      - execution-tmp:/tmp/execution
      - ./services/code-executor/config:/app/config:ro
    security_opt:
      - seccomp:/etc/docker/seccomp/aiide-code.json
      - apparmor:docker-aiide
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m
    networks:
      - aiide-network
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 1G
          pids: 50
        reservations:
          cpus: '0.5'
          memory: 256M
    restart: unless-stopped

  # ============ LLM推理服务 ============
  llm-inference:
    build:
      context: ./services/llm-inference
      dockerfile: Dockerfile
    container_name: aiide-llm
    environment:
      - CUDA_VISIBLE_DEVICES=0
      - TRANSFORMERS_CACHE=/root/.cache/huggingface
      - HF_HOME=/root/.cache/huggingface
      - MODEL_NAME=${LLM_MODEL_NAME}
      - MODEL_TYPE=${LLM_MODEL_TYPE}
      - MAX_LENGTH=4096
      - TEMPERATURE=0.7
      - TOP_P=0.9
    volumes:
      - model-cache:/root/.cache
      - ./services/llm-inference/config:/app/config:ro
    deploy:
      resources:
        limits:
          cpus: '4.0'
          memory: 8G
          memory: 8G
          devices: 1
        reservations:
          cpus: '1.0'
          memory: 4G
    networks:
      - aiide-network
    restart: unless-stopped
    profiles:
      - gpu

  # ============ 文件处理服务 ============
  file-service:
    build:
      context: ./services/file-service
      dockerfile: Dockerfile
    container_name: aiide-file
    environment:
      - MINIO_ENDPOINT=minio:9000
      - MINIO_ACCESS_KEY=${MINIO_ACCESS_KEY}
      - MINIO_SECRET_KEY=${MINIO_SECRET_KEY}
      - MINIO_BUCKET=uploads
      - MAX_FILE_SIZE=104857600
      - ALLOWED_EXTENSIONS=.py,.js,.ts,.go,.rs,.md,.txt,.pdf,.docx
    volumes:
      - uploads:/uploads
      - processed:/processed
      - ./services/file-service/config:/app/config:ro
    depends_on:
      minio:
        condition: service_started
    networks:
      - aiide-network
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 1G
        reservations:
          cpus: '0.5'
          memory: 256M
    restart: unless-stopped

  # ============ 任务调度服务 ============
  task-scheduler:
    build:
      context: ./services/task-scheduler
      dockerfile: Dockerfile
    container_name: aiide-scheduler
    environment:
      - DATABASE_URL=postgresql://aiide:${DB_PASSWORD}@postgres:5432/aiide_tasks
      - REDIS_URL=redis://redis:6379/2
      - SCHEDULER_INTERVAL=60
      - TASK_TIMEOUT=3600
    volumes:
      - ./services/task-scheduler/config:/app/config:ro
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_started
    networks:
      - aiide-network
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
    restart: unless-stopped

  # ============ 数据存储层 ============
  postgres:
    image: postgres:15-alpine
    container_name: aiide-postgres
    environment:
      - POSTGRES_USER=aiide
      - POSTGRES_PASSWORD=${DB_PASSWORD}
      - POSTGRES_DB=aiide
      - POSTGRES_MAX_CONNECTIONS=100
      - POSTGRES_SHARED_BUFFERS=256MB
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./postgres/init:/docker-entrypoint-initdb.d:ro
    command:
      - postgres
      - -c
      - max_connections=100
      - -c
      - shared_buffers=256MB
      - -c
      - effective_cache_size=1GB
      - -c
      - maintenance_work_mem=64MB
      - -c
      - checkpoint_completion_target=0.9
      - -c
      - wal_buffers=16MB
      - -c
      - default_statistics_target=100
      - -c
      - random_page_cost=1.1
      - -c
      - effective_io_concurrency=200
      - -c
      - max_wal_size=4GB
      - -c
      - min_wal_size=1GB
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U aiide"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - aiide-network
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2G
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    container_name: aiide-redis
    command:
      - redis-server
      - --maxmemory
      - 512mb
      - --maxmemory-policy
      - allkeys-lru
      - --appendonly
      - "yes"
      - --appendfsync
      - everysec
    volumes:
      - redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - aiide-network
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
    restart: unless-stopped

  minio:
    image: minio/minio:latest
    container_name: aiide-minio
    environment:
      - MINIO_ROOT_USER=${MINIO_ACCESS_KEY}
      - MINIO_ROOT_PASSWORD=${MINIO_SECRET_KEY}
    volumes:
      - minio-data:/data
    command: server /data --console-address ":9001"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 30s
      timeout: 20s
      retries: 3
    networks:
      - aiide-network
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 1G
    restart: unless-stopped

# ============ 网络定义 ============
networks:
  aiide-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.28.0.0/16

# ============ 卷定义 ============
volumes:
  postgres-data:
    driver: local
  redis-data:
    driver: local
  minio-data:
    driver: local
  model-cache:
    driver: local
  code-workspace:
    driver: local
  execution-tmp:
    driver: local
  uploads:
    driver: local
  processed:
    driver: local
  nginx-logs:
    driver: local

# .env 文件
# 数据库配置
DB_PASSWORD=your_secure_database_password_here

# JWT配置
JWT_SECRET=your_secure_jwt_secret_here_minimum_32_characters

# LLM配置
LLM_MODEL_NAME=THUDM/codegeex2-6b
LLM_MODEL_TYPE=chatglm2

# MinIO配置
MINIO_ACCESS_KEY=aiide_access_key
MINIO_SECRET_KEY=aiide_secret_key_change_in_production

#!/bin/bash
# build.sh - AI IDE后端服务构建脚本

set -e

# 颜色定义
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# 目录定义
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
SERVICES_DIR="${SCRIPT_DIR}/services"
BUILD_DIR="${SCRIPT_DIR}/build"

# 函数定义
log_info() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

log_warn() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}

log_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# 构建单个服务
build_service() {
    local service_name=$1
    local service_dir="${SERVICES_DIR}/${service_name}"
    
    if [ ! -d "${service_dir}" ]; then
        log_error "Service directory not found: ${service_name}"
        return 1
    fi
    
    log_info "Building ${service_name}..."
    
    docker build \
        --network=host \
        --build-arg BUILDKIT_INLINE_CACHE=1 \
        --progress=plain \
        -t "aiide/${service_name}:latest" \
        -t "aiide/${service_name}:${VERSION:-latest}" \
        "${service_dir}"
    
    log_info "Successfully built ${service_name}"
}

# 推送镜像到仓库
push_service() {
    local service_name=$1
    local registry=${REGISTRY:-docker.io}
    local namespace=${NAMESPACE:-aiide}
    
    log_info "Pushing ${service_name} to ${registry}/${namespace}/${service_name}..."
    
    docker push "${registry}/${namespace}/${service_name}:${VERSION:-latest}"
    
    log_info "Successfully pushed ${service_name}"
}

# 主流程
main() {
    VERSION=${VERSION:-$(date +%Y%m%d%H%M)}
    
    log_info "Starting build process for AI IDE services..."
    log_info "Version: ${VERSION}"
    
    # 创建构建目录
    mkdir -p "${BUILD_DIR}"
    
    # 构建所有服务
    for service in auth-service code-executor llm-inference file-service task-scheduler; do
        build_service "${service}"
    done
    
    # 推送镜像（如果指定了PUSH=yes）
    if [ "${PUSH}" = "yes" ]; then
        log_info "Pushing images to registry..."
        for service in auth-service code-executor llm-inference file-service task-scheduler; do
            push_service "${service}"
        done
    fi
    
    log_info "Build process completed successfully!"
}

# 执行主流程
main "$@"

{
  "cluster": "aiide-cluster",
  "taskDefinition": {
    "family": "aiide-backend",
    "cpu": "1024",
    "memory": "2048",
    "containerDefinitions": [
      {
        "name": "aiide-backend",
        "image": "123456789.dkr.ecr.us-east-1.amazonaws.com/aiide/backend:1.0.0",
        "essential": true,
        "portMappings": [
          {
            "containerPort": 8000,
            "protocol": "tcp"
          }
        ],
        "environment": [
          {
            "name": "ENVIRONMENT",
            "value": "production"
          }
        ],
        "logConfiguration": {
          "logDriver": "awslogs",
          "options": {
            "awslogs-group": "/ecs/aiide",
            "awslogs-region": "us-east-1",
            "awslogs-stream-prefix": "ecs"
          }
        },
        "healthCheck": {
          "command": ["CMD-SHELL", "curl -f http://localhost:8000/health || exit 1"],
          "interval": 30,
          "timeout": 5,
          "retries": 3,
          "startPeriod": 15
        }
      }
    ],
    "executionRoleArn": "arn:aws:iam::123456789:role/ecsTaskExecutionRole",
    "networkMode": "awsvpc",
    "requiresCompatibilities": ["FARGATE"]
  }
}

# register-task-definition.sh
aws ecs register-task-definition \
    --family aiide-backend \
    --cpu 1024 \
    --memory 2048 \
    --network-mode awsvpc \
    --requires-compatibilities FARGATE \
    --execution-role-arn arn:aws:iam::123456789:role/ecsTaskExecutionRole \
    --container-definitions '[
        {
            "name": "aiide-backend",
            "image": "123456789.dkr.ecr.us-east-1.amazonaws.com/aiide/backend:1.0.0",
            "essential": true,
            "portMappings": [{"containerPort": 8000}],
            "logConfiguration": {
                "logDriver": "awslogs",
                "options": {
                    "awslogs-group": "/ecs/aiide",
                    "awslogs-stream-prefix": "ecs"
                }
            }
        }
    ]'

# ecs-cluster.yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: AI IDE ECS Cluster with Fargate

Resources:
  # VPC网络
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true

  InternetGateway:
    Type: AWS::EC2::InternetGateway

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: !Select [0, !GetAZs !Ref AWS::Region]

  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.2.0/24
      AvailabilityZone: !Select [0, !GetAZs !Ref AWS::Region]

  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref RouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref RouteTable

  # ECS集群
  Cluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: aiide-cluster

  # 安全组
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: AI IDE ECS Security Group
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0

  # ALB
  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Scheme: internet-facing
      Subnets: [!Ref PublicSubnet]

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Protocol: HTTP
      Port: 8000
      VpcId: !Ref VPC
      TargetType: ip
      HealthCheck:
        Enabled: true
        Path: /health
        Port: 8000
        Protocol: HTTP
        HealthyThresholdCount: 2
        UnhealthyThresholdCount: 3
        Timeout: 5
        Interval: 30

  Listener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref LoadBalancer
      Port: 80
      Protocol: HTTP
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup

  # 服务
  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: aiide-backend
      Cpu: 1024
      Memory: 2048
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      ExecutionRoleArn: !GetAtt ExecutionRole.Arn
      ContainerDefinitions:
        - Name: aiide-backend
          Image: 123456789.dkr.ecr.us-east-1.amazonaws.com/aiide/backend:1.0.0
          Essential: true
          PortMappings:
            - ContainerPort: 8000
          LogConfiguration:
            LogDriver: awslogs
            Options:
              awslogs-group: /ecs/aiide
              awslogs-region: !Ref AWS::Region
              awslogs-stream-prefix: ecs

  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: aiide-ecs-execution-role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ecs-tasks.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: aiide-ecs-execution-policy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ecr:GetAuthorizationToken
                  - ecr:BatchCheckLayerAvailability
                  - ecr:GetDownloadUrlForLayer
                  - ecr:BatchGetImage
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: '*'

  Service:
    Type: AWS::ECS::Service
    DependsOn: LoadBalancer
    Properties:
      Cluster: !Ref Cluster
      ServiceName: aiide-backend-service
      TaskDefinition: !Ref TaskDefinition
      DesiredCount: 2
      LaunchType: FARGATE
      NetworkConfiguration:
        AwsvpcConfiguration:
          Subnets: [!Ref PrivateSubnet]
          SecurityGroups: [!Ref SecurityGroup]
      LoadBalancers:
        - ContainerName: aiide-backend
          ContainerPort: 8000
          TargetGroupArn: !Ref TargetGroup

Outputs:
  LoadBalancerDNS:
    Description: DNS name of the load balancer
    Value: !GetAtt LoadBalancer.DNSName

# aliyun-eci.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: aiide-backend
  namespace: aiide
spec:
  replicas: 2
  selector:
    matchLabels:
      app: aiide-backend
  template:
    metadata:
      labels:
        app: aiide-backend
      annotations:
        k8s.aliyun.com/eci-use-specs: 2-4Gi
        k8s.aliyun.com/eci-spot-strategy: SpotAsPriceGo
    spec:
      containers:
        - name: aiide-backend
          image: registry-vpc.cn-hangzhou.aliyuncs.com/aiide/backend:1.0.0
          ports:
            - containerPort: 8000
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: aiide-secrets
                  key: database-url
          resources:
            requests:
              cpu: "1"
              memory: "2Gi"
            limits:
              cpu: "2"
              memory: "4Gi"
          livenessProbe:
            httpGet:
              path: /health
              port: 8000
            initialDelaySeconds: 10
            periodSeconds: 30
          readinessProbe:
            httpGet:
              path: /ready
              port: 8000
            initialDelaySeconds: 5
            periodSeconds: 10

# cloudrun-service.yaml
apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: aiide-backend
  namespace: default
spec:
  template:
    metadata:
      annotations:
        autoscaling.knative.dev/minScale: "0"
        autoscaling.knative.dev/maxScale: "100"
        run.googleapis.com/startupCpuBoost: "true"
    spec:
      containers:
        - image: gcr.io/aiide-project/backend:1.0.0
          ports:
            - containerPort: 8000
          env:
            - name: ENVIRONMENT
              value: production
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: aiide-secrets
                  key: database-url
          resources:
            limits:
              cpu: "2"
              memory: "4Gi"
          startupProbe:
            httpGet:
              path: /health
              port: 8000
            failureThreshold: 30
            periodSeconds: 10

# 安装gVisor
apt-get install -y apt-transport-https ca-certificates curl
curl -fsSL https://gvisor.dev/archive.key | apt-key add -
echo "deb https://storage.googleapis.com/gvisor/releases release main" > /etc/apt/sources.list.d/gvisor.list
apt-get update && apt-get install -y runsc

# 配置Docker使用gVisor
cat > /etc/docker/daemon.json <<EOF
{
  "runtimes": {
    "runsc": {
      "path": "/usr/bin/runsc"
    }
  }
}
EOF

systemctl restart docker

# 使用gVisor运行容器
docker run --runtime=runsc aiide/backend:1.0.0

# 安装Kata Containers
apt-get install -y apt-transport-https ca-certificates curl
curl -fsSL https://download.kata-containers.io/releases/current/kata-containers.repo | sh
apt-get install -y kata-containers

# 配置Docker使用Kata
cat > /etc/docker/daemon.json <<EOF
{
  "runtimes": {
    "kata": {
      "path": "/usr/bin/kata-runtime"
    }
  }
}
EOF

systemctl restart docker

# 使用Kata运行容器
docker run --runtime=kata aiide/backend:1.0.0

# 安装Firecracker
apt-get install -y firecracker

# 创建微VM配置
cat > config.json <<EOF
{
  "boot-source": "vmlinux",
  "kernel": {
    "image_path": "vmlinux",
    "cmdline": "console=ttyS0 reboot=k panic=1 pci=off"
  },
  "drives": [
    {
      "drive_id": "rootfs",
      "path_on_host": "rootfs.ext4",
      "is_root_device": true,
      "is_read_only": false
    }
  ],
  "machine-config": {
    "vcpu_count": 2,
    "mem_size_mib": 1024
  }
}
EOF

# 启动Firecracker VM
firecracker --api-sock /tmp/firecracker.sock

# 分层隔离架构
services:
  # 可信代码：使用标准Docker
  web-frontend:
    image: aiide/frontend:1.0.0
    runtime: runc
  
  # 半可信代码：使用gVisor
  code-executor:
    image: aiide/executor:1.0.0
    runtime: runsc
  
  # 不可信代码：使用Kata
  sandbox-agent:
    image: aiide/sandbox:1.0.0
    runtime: kata
  
  # 敏感数据处理：使用Firecracker微VM
  llm-inference:
    image: aiide/llm:1.0.0
    runtime: firecracker

# ============================================
# AI IDE Backend - Production Dockerfile
# ============================================
# Multi-stage build for optimal image size and security

# Stage 1: Builder - Dependencies
FROM python:3.11-slim AS builder

WORKDIR /app

# Install build dependencies
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        build-essential \
        libpq-dev \
        libffi-dev \
        libssl-dev \
        git \
        curl \
    && rm -rf /var/lib/apt/lists/*

# Install Python dependencies
COPY requirements.txt .
RUN pip install --prefix=/install --no-cache-dir -r requirements.txt

# Stage 2: Production Runtime
FROM python:3.11-slim AS runtime

# Security: Create non-root user
RUN groupadd --system --gid 1000 aiide && \
    useradd --system --uid 1000 --gid aiide --shell /bin/bash aiide

# Install runtime dependencies
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        libpq5 \
        libffi7 \
        tini \
        gosu \
        curl \
    && rm -rf /var/lib/apt/lists/*

# Copy installed packages from builder
COPY --from=builder /install /usr/local

# Copy application code
COPY --chown=aiide:aiide ./app /app
COPY --chown=aiide:aiide ./config /app/config

WORKDIR /app
USER aiide

# Environment variables
ENV PYTHONUNBUFFERED=1 \
    PYTHONDONTWRITEBYTECODE=1 \
    PYTHONPATH=/app \
    PATH=/usr/local/bin:$PATH

# Health check
HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \
    CMD python -c "import requests; requests.get('http://localhost:8000/health', timeout=5)"

# Expose port
EXPOSE 8000

# Entry point
ENTRYPOINT ["/usr/bin/tini", "--"]

# Application startup
CMD ["gunicorn", "--bind", "0.0.0.0:8000", "--workers", "4", "--worker-class", "uvicorn.workers.UvicornWorker", "--timeout", "120", "--keep-alive", "5", "app.main:app"]

{
  "defaultAction": "SCMP_ACT_ERRNO",
  "defaultErrnoRet": 1,
  "archMap": [
    {
      "architecture": "SCMP_ARCH_X86_64",
      "subArchitectures": ["SCMP_ARCH_X86", "SCMP_ARCH_X32"]
    }
  ],
  "syscalls": [
    {
      "names": [
        "read",
        "write",
        "open",
        "openat",
        "close",
        "pipe",
        "pipe2",
        "select",
        "pselect6",
        "poll",
        "ppoll",
        "epoll_create",
        "epoll_create1",
        "epoll_ctl",
        "epoll_wait",
        "epoll_pwait",
        "readv",
        "writev",
        "preadv",
        "pwritev",
        "recv",
        "recvfrom",
        "recvmsg",
        "send",
        "sendto",
        "sendmsg",
        "shutdown",
        "socket",
        "socketpair",
        "bind",
        "listen",
        "accept",
        "accept4",
        "connect",
        "getsockname",
        "getpeername",
        "getsockopt",
        "setsockopt",
        "clone",
        "vfork",
        "execve",
        "exit",
        "exit_group",
        "wait4",
        "waitid",
        "brk",
        "mmap",
        "mmap2",
        "mprotect",
        "munmap",
        "madvise",
        "mremap",
        "msync",
        "mincore",
        "shmget",
        "shmat",
        "shmctl",
        "shmdt",
        "dup",
        "dup2",
        "dup3",
        "fstat",
        "fstatfs",
        "fstatat",
        "newfstatat",
        "fsync",
        "fdatasync",
        "flock",
        "ioctl",
        "fcntl",
        "truncate",
        "ftruncate",
        "getdents",
        "getcwd",
        "chdir",
        "fchdir",
        "rename",
        "renameat",
        "mkdir",
        "mkdirat",
        "rmdir",
        "unlink",
        "unlinkat",
        "symlink",
        "symlinkat",
        "link",
        "linkat",
        "readlink",
        "readlinkat",
        "chmod",
        "fchmod",
        "chown",
        "fchown",
        "lchown",
        "umask",
        "getuid",
        "getgid",
        "geteuid",
        "getegid",
        "getpid",
        "gettid",
        "getppid",
        "getpgrp",
        "getsid",
        "setsid",
        "setuid",
        "setgid",
        "setreuid",
        "setregid",
        "setpgid",
        "setsid",
        "prctl",
        "arch_prctl",
        "getrlimit",
        "setrlimit",
        "getpriority",
        "setpriority",
        "sched_setscheduler",
        "sched_getscheduler",
        "sched_getparam",
        "sched_setparam",
        "sched_getaffinity",
        "sched_setaffinity",
        "capget",
        "capset",
        "personality",
        "sigaltstack",
        "rt_sigaction",
        "rt_sigreturn",
        "rt_sigprocmask",
        "rt_sigpending",
        "rt_sigsuspend",
        "rt_sigtimedwait",
        "rt_sigqueueinfo",
        "getitimer",
        "setitimer",
        "timer_create",
        "timer_settime",
        "timer_gettime",
        "timer_getoverrun",
        "timer_delete",
        "clock_settime",
        "clock_gettime",
        "clock_getres",
        "clock_nanosleep",
        "nanosleep",
        "gettimeofday",
        "settimeofday",
        "io_setup",
        "io_destroy",
        "io_getevents",
        "io_submit",
        "io_cancel",
        "inotify_init",
        "inotify_init1",
        "inotify_add_watch",
        "inotify_rm_watch",
        "_newselect",
        "eventfd2",
        "signalfd4",
        "timerfd_create",
        "epoll_create1",
        "dup3",
        "pipe2",
        "pread64",
        "pwrite64",
        "quotactl",
        "signalfd",
        "eventfd",
        "memfd_create",
        "unshare",
        "setns",
        "getcpu",
        "process_vm_readv",
        "process_vm_writev"
      ],
      "action": "SCMP_ACT_ALLOW"
    },
    {
      "names": [
        "mount",
        "umount",
        "umount2",
        "pivot_root",
        "acct",
        "kexec_load",
        "init_module",
        "finit_module",
        "delete_module",
        "quotactl",
        "syslog",
        "sysctl",
        "reboot",
        "settimeofday",
        "swapon",
        "swapoff",
        "hdtimerfd_settime",
        "timerfd_settime",
        "perf_event_open",
        "lookup_dcookie",
        "add_key",
        "request_key",
        "keyctl",
        "ioprio_set",
        "ioprio_get",
        "mbind",
        "set_mempolicy",
        "get_mempolicy",
        "migrate_pages",
        "move_pages",
        "vhangup",
        "unshare",
        "setns",
        "shutdown",
        "reboot",
        "restorer"
      ],
      "action": "SCMP_ACT_ERRNO",
      "errnoRet": 1,
      "comment": "These syscalls are disabled for security reasons"
    }
  ]
}

# aiide-backend-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: aiide-backend
  namespace: aiide-production
  labels:
    app: aiide-backend
    version: v1
spec:
  replicas: 3
  selector:
    matchLabels:
      app: aiide-backend
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: aiide-backend
        version: v1
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8000"
        prometheus.io/path: "/metrics"
    spec:
      serviceAccountName: aiide-backend
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
      containers:
        - name: aiide-backend
          image: aiide/backend:1.0.0
          imagePullPolicy: Always
          ports:
            - name: http
              containerPort: 8000
              protocol: TCP
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: aiide-secrets
                  key: database-url
            - name: REDIS_URL
              valueFrom:
                secretKeyRef:
                  name: aiide-secrets
                  key: redis-url
            - name: JWT_SECRET
              valueFrom:
                secretKeyRef:
                  name: aiide-secrets
                  key: jwt-secret
          resources:
            requests:
              cpu: 250m
              memory: 256Mi
            limits:
              cpu: 2000m
              memory: 2Gi
          livenessProbe:
            httpGet:
              path: /health
              port: http
            initialDelaySeconds: 10
            periodSeconds: 30
            timeoutSeconds: 5
            successThreshold: 1
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /ready
              port: http
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 3
            successThreshold: 1
            failureThreshold: 3
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL
          volumeMounts:
            - name: tmp
              mountPath: /tmp
            - name: cache
              mountPath: /app/cache
      volumes:
        - name: tmp
          emptyDir:
            medium: Memory
            sizeLimit: 64Mi
        - name: cache
          emptyDir:
            medium: Memory
            sizeLimit: 256Mi
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchLabels:
                    app: aiide-backend
                topologyKey: kubernetes.io/hostname
      tolerations:
        - key: "node-type"
          operator: "Equal"
          value: "aiide-backend"
          effect: "NoSchedule"