feat: harden orchestrator execution runtime

2026-07-24 23:53:32 +08:00
parent 396bb78200
commit f6f2cd0933
55 changed files with 5122 additions and 194 deletions
@@ -0,0 +1,55 @@
+services:
+  worker-aider:
+    profiles: ["aider-worker"]
+    image: ${MEMIND_AIDER_WORKER_IMAGE:?set a dedicated image containing Node and Aider}
+    command: ["node", "/app/worker.mjs"]
+    restart: unless-stopped
+    environment:
+      MEMIND_ORCHESTRATOR_URL: http://orchestrator:8093
+      MEMIND_ORCHESTRATOR_SERVICE_TOKEN: ${MEMIND_ORCHESTRATOR_SERVICE_TOKEN:?set service token}
+      MEMIND_ORCHESTRATOR_WORKER_TOKEN: ${MEMIND_ORCHESTRATOR_WORKER_TOKEN:?set worker token}
+      MEMIND_EXECUTOR_WORKER_ID: aider-1
+      MEMIND_EXECUTOR_AIDER_COMMAND: /usr/local/bin/aider
+      MEMIND_EXECUTOR_WORKSPACE_ROOT: /workspaces
+      MEMIND_EXECUTOR_WORKSPACE_ALIASES_JSON: ${MEMIND_EXECUTOR_WORKSPACE_ALIASES_JSON:?use container paths below /workspaces}
+    volumes:
+      - ${MEMIND_EXECUTOR_HOST_WORKSPACE_ROOT:?set isolated host workspace root}:/workspaces:rw
+    read_only: true
+    tmpfs:
+      - /tmp:size=256m
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
+    pids_limit: 256
+    mem_limit: 4g
+    cpus: 2
+    networks: [orchestrator_edge]
+
+  worker-openhands:
+    profiles: ["openhands-worker"]
+    image: ${MEMIND_OPENHANDS_WORKER_IMAGE:?set a dedicated image containing Node and OpenHands}
+    command: ["node", "/app/worker.mjs"]
+    restart: unless-stopped
+    environment:
+      MEMIND_ORCHESTRATOR_URL: http://orchestrator:8093
+      MEMIND_ORCHESTRATOR_SERVICE_TOKEN: ${MEMIND_ORCHESTRATOR_SERVICE_TOKEN:?set service token}
+      MEMIND_ORCHESTRATOR_WORKER_TOKEN: ${MEMIND_ORCHESTRATOR_WORKER_TOKEN:?set worker token}
+      MEMIND_EXECUTOR_WORKER_ID: openhands-1
+      MEMIND_EXECUTOR_OPENHANDS_COMMAND: /usr/local/bin/openhands
+      MEMIND_EXECUTOR_WORKSPACE_ROOT: /workspaces
+      MEMIND_EXECUTOR_WORKSPACE_ALIASES_JSON: ${MEMIND_EXECUTOR_WORKSPACE_ALIASES_JSON:?use container paths below /workspaces}
+    volumes:
+      - ${MEMIND_EXECUTOR_HOST_WORKSPACE_ROOT:?set isolated host workspace root}:/workspaces:rw
+    read_only: true
+    tmpfs:
+      - /tmp:size=512m
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
+    pids_limit: 512
+    mem_limit: 8g
+    cpus: 4
+    networks: [orchestrator_edge]
+
+networks:
+  orchestrator_edge:
+    external: true
+    name: orchestrator_orchestrator_edge