tkmind/memind
1
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

feat: harden orchestrator execution runtime

Browse Source
This commit is contained in:
john
2026-07-24 23:53:32 +08:00
parent 396bb78200
commit f6f2cd0933
55 changed files with 5122 additions and 194 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/orchestrator/compose.yaml
+42
View File
@@ -32,12 +32,54 @@ services:
MEMIND_ORCHESTRATOR_DATABASE_URL: postgresql://memind_orchestrator:${ORCHESTRATOR_POSTGRES_PASSWORD}@postgres:5432/memind_orchestrator
MEMIND_ORCHESTRATOR_DATABASE_SCHEMA: memind_orchestrator
MEMIND_ORCHESTRATOR_SERVICE_TOKEN: ${MEMIND_ORCHESTRATOR_SERVICE_TOKEN:?set MEMIND_ORCHESTRATOR_SERVICE_TOKEN}
MEMIND_ORCHESTRATOR_WORKER_TOKEN: ${MEMIND_ORCHESTRATOR_WORKER_TOKEN:-local-worker-disabled}
MEMIND_ORCHESTRATOR_EXECUTION_ENABLED: ${MEMIND_ORCHESTRATOR_EXECUTION_ENABLED:-0}
MEMIND_ORCHESTRATOR_ENABLED_EXECUTORS: ${MEMIND_ORCHESTRATOR_ENABLED_EXECUTORS:-}
MEMIND_ORCHESTRATOR_TENANT_ALLOWLIST: ${MEMIND_ORCHESTRATOR_TENANT_ALLOWLIST:-}
MEMIND_ORCHESTRATOR_USER_ALLOWLIST: ${MEMIND_ORCHESTRATOR_USER_ALLOWLIST:-}
MEMIND_ORCHESTRATOR_WORKSPACE_KIND_ALLOWLIST: ${MEMIND_ORCHESTRATOR_WORKSPACE_KIND_ALLOWLIST:-workspace-alias}
MEMIND_ORCHESTRATOR_MAX_GLOBAL_ACTIVE: ${MEMIND_ORCHESTRATOR_MAX_GLOBAL_ACTIVE:-20}
MEMIND_ORCHESTRATOR_MAX_TENANT_ACTIVE: ${MEMIND_ORCHESTRATOR_MAX_TENANT_ACTIVE:-5}
MEMIND_ORCHESTRATOR_MAX_USER_ACTIVE: ${MEMIND_ORCHESTRATOR_MAX_USER_ACTIVE:-2}
MEMIND_ORCHESTRATOR_MAX_TENANT_PER_MINUTE: ${MEMIND_ORCHESTRATOR_MAX_TENANT_PER_MINUTE:-30}
MEMIND_ORCHESTRATOR_MAX_USER_PER_MINUTE: ${MEMIND_ORCHESTRATOR_MAX_USER_PER_MINUTE:-10}
ports:
- "127.0.0.1:${MEMIND_ORCHESTRATOR_PORT:-8093}:8093"
networks:
- orchestrator_internal
- orchestrator_edge
worker-goosed:
profiles: ["goosed-worker"]
image: memind/workflow-orchestrator:local
restart: unless-stopped
command: ["node", "worker.mjs"]
depends_on:
orchestrator:
condition: service_started
environment:
MEMIND_ORCHESTRATOR_URL: http://orchestrator:8093
MEMIND_ORCHESTRATOR_SERVICE_TOKEN: ${MEMIND_ORCHESTRATOR_SERVICE_TOKEN:?set MEMIND_ORCHESTRATOR_SERVICE_TOKEN}
MEMIND_ORCHESTRATOR_WORKER_TOKEN: ${MEMIND_ORCHESTRATOR_WORKER_TOKEN:-local-worker-disabled}
MEMIND_EXECUTOR_WORKER_ID: ${MEMIND_EXECUTOR_GOOSED_WORKER_ID:-colima-goosed-1}
MEMIND_EXECUTOR_GOOSED_URL: ${MEMIND_EXECUTOR_GOOSED_URL:-http://host.docker.internal:18006}
MEMIND_EXECUTOR_GOOSED_TOKEN: ${MEMIND_EXECUTOR_GOOSED_TOKEN:-}
MEMIND_EXECUTOR_ALLOW_REMOTE_GOOSED: "1"
MEMIND_EXECUTOR_WORKSPACE_ALIASES_JSON: ${MEMIND_EXECUTOR_WORKSPACE_ALIASES_JSON:-{}}
MEMIND_EXECUTOR_POLL_MS: ${MEMIND_EXECUTOR_POLL_MS:-1000}
MEMIND_EXECUTOR_HEARTBEAT_MS: ${MEMIND_EXECUTOR_HEARTBEAT_MS:-10000}
MEMIND_EXECUTOR_LEASE_MS: ${MEMIND_EXECUTOR_LEASE_MS:-30000}
read_only: true
tmpfs:
- /tmp:size=64m
cap_drop:
- ALL
security_opt:
- no-new-privileges:true
pids_limit: 128
networks:
- orchestrator_edge
networks:
orchestrator_internal:
internal: true