alvis
9094d71e2f
Retires the Moonshot/Kimi subscription in favour of the already-paid ChatGPT plan. Both CLI wrappers now run `codex exec`; the kimi-agent container is gone. adolf-llm + hindsight-llm: - runKimi -> runCodex (`codex exec --json --skip-git-repo-check`), resume via `codex exec resume <thread_id>`. - MCP moves from a per-session .mcp.json (a workaround for Kimi having no --mcp-config-file flag) to a $CODEX_HOME/config.toml generated once at startup from shared-mcp.json. Field translation is load-bearing: bearerTokenEnvVar -> bearer_token_env_var, enabledTools -> enabled_tools. - approval_policy="never" + sandbox_mode required, or unattended turns block on an approval prompt nobody can answer. kimi-agent removed. It was the ONLY large-tier deployment behind LiteLLM, so deleting it outright would have silently degraded every large-tier request to the local 4B model via the existing fallbacks. tier-large, the auto_router complex-reasoning route and their fallbacks now point at the codex-backed adolf-llm wrapper (model_name: codex-agent). Three environment blockers fixed along the way: - OpenAI geo-blocks this host (403 unsupported_country_region_territory). Both containers now egress via the host xray proxy, with NO_PROXY keeping MCP and *.alogins.net traffic off the tunnel. - node:22-slim ships no system CA store; the Rust codex binary validates TLS against it, so every HTTPS call failed with a generic transport error while Node's own fetch worked. ca-certificates added to both images. - `codex exec resume` rejects -C/--cd (plain `codex exec` accepts it), which broke follow-up turns while first turns succeeded. Known regression: Kimi's managed-usage API has no Codex equivalent, so the /usage route returns 501 and there is no quota probe for the codex model. The two quota plugins degrade quietly to no output. Also: stop tracking cognee.env (live LLM + JWT secrets) and gitignore it. The secrets remain in earlier history and should be rotated. Verified live: plain turn, SSE streaming, session resume, MCP tool call, bearer-token MCP call, and completions through both LiteLLM routes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014Y5QPagv4iun1ghpwM96Ff
67 lines
4.0 KiB
Docker
67 lines
4.0 KiB
Docker
# Adolf P4 — cognee memory service.
|
|
#
|
|
# Base: official upstream image (do not hand-roll cognee itself). Adds ONE
|
|
# thing upstream doesn't ship: Qdrant vector-store support. Qdrant is a
|
|
# *community* adapter (separate PyPI package, not one of cognee's own
|
|
# `[project.optional-dependencies]` extras — the image's own EXTRAS=
|
|
# mechanism only installs cognee's own extras, so it can't pull this in).
|
|
#
|
|
# Version note: cognee-community-vector-adapter-qdrant's declared dependency
|
|
# pin (both the PyPI release 0.2.4 -> cognee==0.5.6, and the unreleased
|
|
# GitHub main 0.3.0 -> cognee==1.1.0) trails this image's cognee 1.2.2.
|
|
# Installed with --no-deps (below) to avoid pip fighting that pin and
|
|
# downgrading cognee. Verified compatible by direct import test on 2026-07-05:
|
|
# both registry hooks the adapter calls (`use_vector_adapter`,
|
|
# `use_dataset_database_handler` from cognee.infrastructure.databases.*)
|
|
# exist unchanged in cognee 1.2.2, and a full container import of
|
|
# cognee_community_vector_adapter_qdrant.register succeeds with no error
|
|
# against this exact image. Not yet exercised against a live Qdrant round
|
|
# trip (cognify + search) — do that once the LiteLLM LLM/embedder blockers
|
|
# below are resolved, as a final confirmation.
|
|
FROM cognee/cognee:1.2.2
|
|
|
|
# qdrant-client is the adapter's one genuinely-missing runtime dependency
|
|
# (starlette/instructor are already satisfied by cognee's own base deps).
|
|
# Installed normally (with deps) since it's a fresh package, not a conflict.
|
|
RUN /usr/local/bin/pip --python /app/.venv/bin/python install --no-cache-dir \
|
|
"qdrant-client>=1.18.0"
|
|
|
|
# Pinned to a specific commit for reproducibility (no tagged release exists
|
|
# yet compatible with our cognee version — see version note above).
|
|
RUN /usr/local/bin/pip --python /app/.venv/bin/python install --no-cache-dir --no-deps \
|
|
"https://github.com/topoteretes/cognee-community/archive/52281288052970f57e533b9be75b64da9ac7c773.tar.gz#subdirectory=packages/vector/qdrant"
|
|
|
|
# sitecustomize.py auto-imports at every Python interpreter start in this
|
|
# venv. Gated on VECTOR_DB_PROVIDER so it's a no-op unless qdrant is actually
|
|
# selected — this is the adapter's own documented registration call
|
|
# (cognee-community-vector-adapter-qdrant README: "Import and register the
|
|
# adapter in your code: from cognee_community_vector_adapter_qdrant import
|
|
# register"), just run automatically instead of requiring a cognee source
|
|
# edit to add the import.
|
|
RUN printf '%s\n' \
|
|
'import os' \
|
|
'if os.environ.get("VECTOR_DB_PROVIDER") == "qdrant":' \
|
|
' from cognee_community_vector_adapter_qdrant import register # noqa: F401' \
|
|
> /app/.venv/lib/python3.12/site-packages/sitecustomize.py
|
|
|
|
# Pre-installed Kuzu/Ladybug JSON extension (P4 deploy blocker fix, 2026-07-05).
|
|
# cognee's graph adapter (cognee/infrastructure/databases/graph/ladybug/adapter.py)
|
|
# always tries `LOAD EXTENSION JSON` on startup and on every /health graph check,
|
|
# falling back to `INSTALL JSON` (a network download from
|
|
# extension.ladybugdb.com) if not already cached at
|
|
# ~/.lbdb/extension/<kuzu_version>/<platform>/json/libjson.lbug_extension. This
|
|
# extension is required for recall/temporal-search graph queries — without it
|
|
# cognee's /health reports "unhealthy" and graph queries that use JSON fail
|
|
# with a Binder exception ("Extension: json ... has not been installed").
|
|
#
|
|
# This deployment's egress to extension.ladybugdb.com is severely
|
|
# bandwidth-throttled (~1-1.2 KB/s per connection — confirmed via direct curl,
|
|
# not a proxy/DNS block: TLS handshake and HTTP 200 succeed, the transfer
|
|
# itself just crawls), so the runtime auto-download reliably times out before
|
|
# the ~827KB file finishes, and every subsequent health check/query re-attempts
|
|
# and fails the same way. Downloaded once out-of-band (16-way parallel ranged
|
|
# GETs, ~846920 bytes, verified ELF shared object) and baked into the image
|
|
# here so the container never needs to touch that host at runtime.
|
|
COPY extensions/0.17.0/linux_amd64/json/libjson.lbug_extension \
|
|
/root/.lbdb/extension/0.17.0/linux_amd64/json/libjson.lbug_extension
|