Conversation
…ation to avoid heavy transformers installation
- Fix MemoryItem interface conflict between types.ts and core-services.ts - Update import to use correct MemoryItem interface from core-services.ts - Remove non-existent performance_metrics property from AgentState - Fix error_info to error_message property reference - Resolves Docker build failure due to TypeScript compilation errors
WalkthroughThis update introduces a comprehensive Docker-based development and deployment setup for the Sentient Core project. It adds multiple Dockerfiles for various build strategies, several Docker Compose configurations for different environments, extensive setup and troubleshooting documentation, helper scripts, and new or updated TypeScript interfaces for frontend API types. The Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Developer
participant Docker as Docker Engine
participant Compose as Docker Compose
participant BE as Backend Container
participant FE as Frontend Container
participant Streamlit as Streamlit UI Container
Dev->>Docker: Build images (Dockerfile variants)
Dev->>Compose: Start services (docker-compose up)
Compose->>BE: Launch backend (FastAPI/Uvicorn)
Compose->>FE: Launch frontend (Next.js)
Compose->>Streamlit: Launch Streamlit UI
FE->>BE: API calls (port 8000)
Streamlit->>BE: API calls (port 8000)
Dev->>Compose: View logs, restart, or rebuild as needed
Poem
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 11
🔭 Outside diff range comments (1)
sentient-core/.gitignore (1)
45-55: Conflicting guidance:.envis simultaneously “kept” and “ignored”.Lines 45-51 explicitly list the various
.env*files under “Keep environment files”, yet line 55 now ignores.env.
This contradiction will confuse contributors and tooling (e.g.pre-commit, CI). Decide on one policy and remove the redundant/opposite rule.-# Keep environment files -# .env ... -.env # now ignored +# Ignore environment files +.env +.env.*
🧹 Nitpick comments (21)
sentient-core/frontend/Dockerfile.dev (1)
5-11: Minor optimisation: leverage Docker layer caching for faster dev rebuilds.Copying the entire source before dependency install negates cache benefits. Copy
package*.jsonfirst, runnpm ci, then copy the rest (as done, good). For live-reload scenarios the source will be volume-mounted, so you can skip the secondCOPYentirely and trim image size:-# Copy application code -COPY . . +# Source will be mounted by docker-compose; avoid bloating the imageOptional but keeps rebuilds snappy.
sentient-core/Dockerfile.minimal (3)
5-11: Add--no-install-recommendsto keep the slim image truly slim.
apt-get install -y build-essential curl gitwithout--no-install-recommendspulls in ~80 MB of extras. Append the flag:- build-essential \ + --no-install-recommends \ + build-essential \Also consider dropping compilers after wheels are built:
apt-get purge -y build-essential && apt-get autoremove -y.
17-23: Pin Python dependencies for repeatable, secure builds.Installing latest versions every build risks future breakages. Either:
- Convert
requirements-minimal.txtto fully pinnedpkg==x.y.zversions, or- Generate a lock file (
pip-tools,poetry export, etc.) and install from it.This ensures deterministic images and easier CVE tracking.
24-31: Run as non-root for better container security.After installing packages:
# --- add just before EXPOSE --- RUN adduser --disabled-password --gecos '' appuser && chown -R appuser /app USER appuserReduces privilege-escalation risk in prod environments.
sentient-core/install-optional-deps.sh (1)
8-23: Consolidatepipinvocations and upgrade the installer.Three separate
pip installcalls prolong network time and increase image layers. Upgradepiponce and install all extras in one shot viapython -m pipto avoid the “wrong-pip” edge case in some images.-echo "Installing optional dependencies..." - -# Install vector database and search dependencies -pip install --no-cache-dir \ - chromadb \ - sentence-transformers \ - faiss-cpu - -# Install search APIs -pip install --no-cache-dir \ - tavily-python \ - exa-py \ - duckduckgo-search - -# Install additional AI frameworks -pip install --no-cache-dir \ - pyautogen - -echo "Optional dependencies installed successfully!" +echo "Installing optional dependencies..." + +# Always upgrade pip first +python -m pip install --no-cache-dir --upgrade pip + +# Install all optional packages in a single layer +python -m pip install --no-cache-dir \ + chromadb \ + sentence-transformers \ + faiss-cpu \ + tavily-python \ + exa-py \ + duckduckgo-search \ + pyautogen + +echo "Optional dependencies installed successfully!"sentient-core/Dockerfile.alt (2)
5-10: Slim the base layer & cut image size.Use
--no-install-recommendsand cleanaptcache in one layer to avoid extra megabytes.-RUN apt-get update && apt-get install -y \ - build-essential \ - curl \ - git \ - && rm -rf /var/lib/apt/lists/* +RUN apt-get update && apt-get install -y --no-install-recommends \ + build-essential \ + curl \ + git \ + && rm -rf /var/lib/apt/lists/*
15-23: Retry loop is brittle; split logic for clarity.
pip install … && break || …works but is hard to parse and can swallow non-pip failures. Prefer an explicit check on$?.-RUN pip install --upgrade pip && \ - pip install --no-cache-dir wheel setuptools && \ - for i in $(seq 1 3); do \ - echo "Attempt $i: Installing requirements..." && \ - pip install --no-cache-dir -r requirements.txt && break || \ - echo "Attempt $i failed, retrying..." && \ - sleep 5; \ - done +RUN python -m pip install --no-cache-dir --upgrade pip wheel setuptools && \ + for i in 1 2 3; do \ + echo "Attempt $i: Installing requirements..." && \ + if python -m pip install --no-cache-dir -r requirements.txt; then \ + break; \ + fi; \ + echo "Attempt $i failed, retrying in 5s…"; \ + sleep 5; \ + donesentient-core/docker-compose.alt.yml (2)
49-51: YAML lint warnings: trailing spaces & missing final newline.Remove the trailing whitespace and ensure the file ends with a single newline to satisfy CI linting hooks.
sentient-network: - driver: bridge␠ + driver: bridge + +# EOF
12-16: Duplicate environment variables across services – extract to.envor anchors.Both services define identical
PYTHONUNBUFFERED,DATABASE_URL, andVECTOR_DB_PATH. Centralising them reduces drift.sentient-core/docker-compose.minimal.yml (2)
40-42: Same YAML lint issue as in alt compose.A final newline is required and trailing spaces should be trimmed.
sentient-network: - driver: bridge␠ + driver: bridge + +# EOF
24-33: Hard-coded backend URL couples services to internal host names.Consider using the compose service name with the protocol inside the container:
http://backend:8000works, but expose it via an env in the backend or default in code to avoid repeating the port mapping if it changes.sentient-core/docker-run.sh (1)
118-124: Fall-through for unknown commands exits 0.The script echoes the help and
exit 1, but earlier unknown path might still succeed; verify all branches return non-zero on error.sentient-core/Dockerfile (1)
5-11: Tiny optimisation: add--no-install-recommendsto shrink image by ~40 MB-RUN apt-get update && apt-get install -y \ +RUN apt-get update && apt-get install -y --no-install-recommends \This keeps the slim base…well, slim.
sentient-core/docker-compose.dev.yml (1)
74-76: Trailing whitespace and missing EOF newline break YAML linting
Both yaml-lint errors can be fixed with one-line patch:- driver: bridge␠ + driver: bridge +sentient-core/docker-compose.yml (1)
71-73: YAML lint: trim trailing spaces + add final newline- sentient-network: - driver: bridge␠ + sentient-network: + driver: bridge +sentient-core/Dockerfile.optimized (1)
24-35:COPY requirements.txtis dead code – duplicates manual lists & risks drift
The file is never used afterwards; dependency lists now live in the Dockerfile. Either (1) delete theCOPY requirements.txtline or (2) replace the hard-codedpip install …blocks with a singlepip install -r requirements.txtto avoid duplication.sentient-core/DOCKER_SETUP_GUIDE.md (1)
40-42: Markdown lint: wrap bare URLs & add fence language spec
Convert raw links (http://…) to[text](url)format and tag the directory tree with ```text for clean rendering.Also applies to: 129-134, 393-394
sentient-core/DOCKER.md (4)
14-25: Specify a language identifier for the.envblock and add a cautionary noteThe fenced code block that shows the
.envcontents omits a language identifier, triggeringmarkdownlint(MD040) and missing out on syntax highlighting.
At the same time, it’s worth explicitly warning contributors not to commit real keys.-``` +# .env +```dotenv # LLM API Keys GROQ_API_KEY=your_groq_api_key @@ E2B_API_KEY=your_e2b_api_key
+> Security note: never commit the populated
.envfile; keep real keys in an un-tracked
+> copy or a secrets manager.--- `27-36`: **Consolidate the two “minimal / fastest build” sections** The document describes the minimal setup twice (lines 27-36 and 76-88). This duplication makes the guide longer than necessary and creates a maintenance hotspot if commands change. Consider merging them into a single “Minimal (fastest) build” subsection and referring to it from the quick-start bullet. Doing so will improve readability and keep the instructions DRY. Also applies to: 76-88 --- `136-139`: **Replace bare service URLs with Markdown links for lint-clean docs** `markdownlint` flags bare URLs (MD034). Converting them to clickable links also improves the reading experience: ```diff -Backend API: http://localhost:8000 -Frontend: http://localhost:3000 -Streamlit UI: http://localhost:8501 +Backend API: <http://localhost:8000> +Frontend: <http://localhost:3000> +Streamlit UI: <http://localhost:8501>
123-132: Minor JSON formatting tipWhen presenting the
daemon.jsonsnippet, adding a trailing newline after the closing brace prevents copy-paste warnings from some linters and IDEs. Optional but improves polish.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (19)
sentient-core/.gitignore(1 hunks)sentient-core/DOCKER.md(1 hunks)sentient-core/DOCKER_SETUP_GUIDE.md(1 hunks)sentient-core/Dockerfile(1 hunks)sentient-core/Dockerfile.alt(1 hunks)sentient-core/Dockerfile.minimal(1 hunks)sentient-core/Dockerfile.optimized(1 hunks)sentient-core/docker-compose.alt.yml(1 hunks)sentient-core/docker-compose.dev.yml(1 hunks)sentient-core/docker-compose.minimal.yml(1 hunks)sentient-core/docker-compose.yml(1 hunks)sentient-core/docker-run.sh(1 hunks)sentient-core/frontend/Dockerfile(1 hunks)sentient-core/frontend/Dockerfile.dev(1 hunks)sentient-core/frontend/components/core-services-dashboard.tsx(2 hunks)sentient-core/frontend/lib/api/core-services.ts(2 hunks)sentient-core/frontend/lib/api/types.ts(1 hunks)sentient-core/install-optional-deps.sh(1 hunks)sentient-core/requirements-minimal.txt(1 hunks)
🧰 Additional context used
🧬 Code Graph Analysis (1)
sentient-core/frontend/lib/api/types.ts (1)
sentient-core/frontend/lib/api/core-services.ts (5)
AgentState(44-49)WorkflowState(51-62)MemoryItem(33-42)SearchResult(64-72)ServiceHealth(74-84)
🪛 YAMLlint (1.37.1)
sentient-core/docker-compose.minimal.yml
[error] 42-42: no new line character at the end of file
(new-line-at-end-of-file)
[error] 42-42: trailing spaces
(trailing-spaces)
sentient-core/docker-compose.dev.yml
[error] 76-76: no new line character at the end of file
(new-line-at-end-of-file)
[error] 76-76: trailing spaces
(trailing-spaces)
sentient-core/docker-compose.alt.yml
[error] 51-51: no new line character at the end of file
(new-line-at-end-of-file)
[error] 51-51: trailing spaces
(trailing-spaces)
sentient-core/docker-compose.yml
[error] 73-73: no new line character at the end of file
(new-line-at-end-of-file)
[error] 73-73: trailing spaces
(trailing-spaces)
🪛 LanguageTool
sentient-core/DOCKER_SETUP_GUIDE.md
[typographical] ~71-~71: If specifying a range, consider using an en dash instead of a hyphen.
Context: ...ent with all features. Build Time: 30-60 minutes (depending on network) ```bash...
(HYPHEN_TO_EN)
[uncategorized] ~138-~138: This verb may not be in the correct tense. Consider changing the tense to fit the context better.
Context: ...ild Times Were Long The original build was taking 50+ minutes due to: 1. **Heavy ML Pack...
(AI_EN_LECTOR_REPLACEMENT_VERB_TENSE)
[grammar] ~347-~347: Did you mean the adjective “useful”?
Context: ... ### Recommended Production Setup 1. Use Full Setup: For complete feature set ``...
(THANK_FULL)
sentient-core/DOCKER.md
[duplication] ~7-~7: Possible typo: you repeated a word.
Context: ...ion using Docker. ## Prerequisites - Docker - [Docker Compose](https://docs.docker.com/compos...
(ENGLISH_WORD_REPEAT_RULE)
[style] ~154-~154: Consider shortening or rephrasing this to strengthen your wording.
Context: ...lit ## Rebuilding Services If you make changes to dependencies or Dockerfiles: bash d...
(MAKE_CHANGES)
🪛 markdownlint-cli2 (0.17.2)
sentient-core/DOCKER_SETUP_GUIDE.md
40-40: Bare URL used
(MD034, no-bare-urls)
41-41: Bare URL used
(MD034, no-bare-urls)
129-129: Bare URL used
(MD034, no-bare-urls)
131-131: Bare URL used
(MD034, no-bare-urls)
132-132: Bare URL used
(MD034, no-bare-urls)
318-318: Bare URL used
(MD034, no-bare-urls)
393-393: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
sentient-core/DOCKER.md
14-14: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
136-136: Bare URL used
(MD034, no-bare-urls)
137-137: Bare URL used
(MD034, no-bare-urls)
138-138: Bare URL used
(MD034, no-bare-urls)
🪛 Checkov (3.2.334)
sentient-core/Dockerfile
[HIGH] 28-40: Ensure that certificate validation isn't disabled with the PYTHONHTTPSVERIFY environmnet variable
(CKV2_DOCKER_5)
🔇 Additional comments (5)
sentient-core/frontend/components/core-services-dashboard.tsx (2)
7-7: LGTM: Import path refactoring is well-organized.The import path change from
'../lib/api'to'../lib/api/core-services'improves code organization by creating more specific API modules.
374-376: LGTM: Property rename is consistent with interface changes.The change from
state.error_infotostate.error_messagecorrectly reflects the interface update in theAgentStatetype definition.sentient-core/frontend/lib/api/core-services.ts (2)
45-48: LGTM: AgentState interface improvements are well-structured.The removal of the 'offline' status and renaming of
error_infotoerror_messageimproves interface clarity and consistency.
79-81: LGTM: ServiceHealth interface enhancements improve monitoring capabilities.The addition of
llm_serviceandoverall_statusproperties, along with makingtimestampoptional, enhances the service health monitoring capabilities.sentient-core/docker-run.sh (1)
91-96:build:timeoutignores alternative/minimal compose stacks.The extra build args are great, but they’re only applied to the default stack. Provide a flag to combine with
alt/minimalor document the limitation.
| // Agent State types | ||
| export interface AgentState { | ||
| status: 'active' | 'busy' | 'idle' | 'error'; | ||
| current_task?: string; | ||
| last_activity?: string; | ||
| error_message?: string; | ||
| } | ||
|
|
||
| // Workflow types | ||
| export interface Workflow { | ||
| id: string; | ||
| name: string; | ||
| description: string; | ||
| icon?: string; | ||
| } | ||
|
|
||
| export interface WorkflowState { | ||
| id: string; | ||
| status: 'running' | 'completed' | 'failed' | 'paused'; | ||
| current_step?: string; | ||
| progress?: number; | ||
| created_at: string; | ||
| updated_at?: string; | ||
| } | ||
|
|
||
| // Memory types | ||
| export interface MemoryItem { | ||
| id: string; | ||
| content: string; | ||
| type: 'text' | 'image' | 'file'; | ||
| created_at: string; | ||
| metadata?: any; | ||
| } | ||
|
|
||
| // Search types | ||
| export interface SearchResult { | ||
| id: string; | ||
| title: string; | ||
| content: string; | ||
| url?: string; | ||
| source: string; | ||
| relevance_score?: number; | ||
| created_at: string; | ||
| } | ||
|
|
||
| // Service Health types | ||
| export interface ServiceHealth { | ||
| memory_service: boolean; | ||
| state_service: boolean; | ||
| search_service: boolean; | ||
| vector_service: boolean; | ||
| llm_service?: boolean; | ||
| overall_status: 'healthy' | 'degraded' | 'down'; | ||
| } | ||
|
|
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Critical: Duplicate interface definitions create maintenance issues.
The interfaces added here (AgentState, WorkflowState, MemoryItem, SearchResult, ServiceHealth) duplicate those in core-services.ts but with different field structures. This creates several problems:
-
Interface inconsistencies:
WorkflowStateusesidhere vsworkflow_idin core-services.tsMemoryItemusestypehere vslayer/memory_typein core-services.tsSearchResulthasidhere but not in core-services.tsServiceHealthmissing fields likestate_performanceandmemory_stats
-
Import confusion: Components may accidentally import from the wrong file
-
Maintenance burden: Changes need to be made in multiple places
Recommendation: Consolidate these interfaces by either:
- Moving all core service interfaces to this file and importing them in core-services.ts
- Removing duplicates from this file and importing from core-services.ts
- Creating a clear separation of concerns between generic types and service-specific types
🏁 Script executed:
#!/bin/bash
# Check for interface usage across the codebase to understand import patterns
echo "=== Checking AgentState usage ==="
rg "AgentState" --type ts -A 2 -B 2
echo "=== Checking WorkflowState usage ==="
rg "WorkflowState" --type ts -A 2 -B 2
echo "=== Checking interface imports ==="
rg "import.*\{.*AgentState.*\}" --type ts
rg "import.*\{.*WorkflowState.*\}" --type ts
rg "import.*\{.*ServiceHealth.*\}" --type tsLength of output: 12885
Consolidate API type definitions into a single source of truth
The interfaces in frontend/lib/api/types.ts duplicate those in frontend/lib/api/core-services.ts, with divergent shapes and split imports across components. This fragmentation leads to inconsistent typings and extra maintenance:
• AgentState
– Defined in both files, used from types.ts in orchestrator-interface.tsx and from core-services.ts in core-services-dashboard.tsx.
• WorkflowState
– types.ts uses id: string, while core-services.ts uses workflow_id: string and has a different status enum.
• MemoryItem vs memory stats
– types.ts has { id, content, type } vs core-services.ts reports memory stats under a different shape.
• SearchResult
– Present in types.ts but not in core-services.ts; fields don’t align.
• ServiceHealth
– Missing state_performance and memory_stats fields defined in core-services.ts.
Components importing mixed sources:
frontend/components/orchestrator-interface.tsximports from../lib/api(i.e. types.ts).frontend/components/core-services-dashboard.tsximports from../lib/api/core-services.
–––
Recommended fix:
- Pick one file as the canonical API–type definition (e.g.
types.ts). - Consolidate and align all interface fields in that file.
- In
core-services.ts, import and re-export those interfaces instead of redefining them. - Update all component imports to pull types from the single source.
Files to update:
- frontend/lib/api/types.ts
- frontend/lib/api/core-services.ts
- frontend/components/orchestrator-interface.tsx
- frontend/components/core-services-dashboard.tsx
🤖 Prompt for AI Agents
In frontend/lib/api/types.ts lines 22 to 76, the API type interfaces are
duplicated and inconsistent with those in frontend/lib/api/core-services.ts,
causing fragmented imports and maintenance issues. To fix this, consolidate all
API type definitions into frontend/lib/api/types.ts as the single source of
truth by merging and aligning all interface fields from both files. Then, modify
core-services.ts to import and re-export these unified interfaces instead of
redefining them. Finally, update all component imports in
orchestrator-interface.tsx and core-services-dashboard.tsx to import types
exclusively from the consolidated types.ts file.
| # Install dependencies | ||
| COPY package.json package-lock.json ./ | ||
| RUN npm ci | ||
|
|
||
| # Copy application code | ||
| COPY . . | ||
|
|
||
| # Build the application | ||
| RUN npm run build | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Production image still carries dev dependencies & source – switch to a multi-stage build.
npm ci installs all dev dependencies; after npm run build they’re never removed, and the final image keeps the full source tree, inflating size and attack surface.
Use a two-stage build or npm ci --omit=dev + npm prune --omit=dev.
-FROM node:18-alpine
+FROM node:18-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build
+# --- runtime stage ---
+FROM node:18-alpine
+WORKDIR /app
+ENV NODE_ENV=production
+COPY --from=builder /app/package*.json ./
+RUN npm ci --omit=dev && npm cache clean --force
+COPY --from=builder /app/.next ./.next
+COPY --from=builder /app/public ./public
+
EXPOSE 3000
CMD ["npm", "start"]This cuts 100 - 300 MB and removes dev tools.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # Install dependencies | |
| COPY package.json package-lock.json ./ | |
| RUN npm ci | |
| # Copy application code | |
| COPY . . | |
| # Build the application | |
| RUN npm run build | |
| # --- build stage --- | |
| FROM node:18-alpine AS builder | |
| WORKDIR /app | |
| # Install all dependencies (including dev) | |
| COPY package*.json ./ | |
| RUN npm ci | |
| # Copy source & build | |
| COPY . . | |
| RUN npm run build | |
| # --- runtime stage --- | |
| FROM node:18-alpine | |
| WORKDIR /app | |
| ENV NODE_ENV=production | |
| # Install only production dependencies | |
| COPY --from=builder /app/package*.json ./ | |
| RUN npm ci --omit=dev && npm cache clean --force | |
| # Copy build artifacts | |
| COPY --from=builder /app/.next ./.next | |
| COPY --from=builder /app/public ./public | |
| EXPOSE 3000 | |
| CMD ["npm", "start"] |
🤖 Prompt for AI Agents
In sentient-core/frontend/Dockerfile lines 5 to 14, the current Dockerfile
installs all dependencies including dev dependencies and copies the full source
into the final image, which increases size and attack surface. To fix this,
refactor the Dockerfile to use a multi-stage build: in the first stage, install
all dependencies and build the app; in the second stage, copy only the built
artifacts and production dependencies, excluding dev dependencies and source
files. This will significantly reduce the final image size and remove
unnecessary dev tools.
| # Core web framework | ||
| fastapi | ||
| uvicorn[standard] | ||
|
|
||
| # Data validation | ||
| pydantic | ||
|
|
||
| # Environment management | ||
| python-dotenv | ||
|
|
||
| # Core AI frameworks (minimal set) | ||
| langchain | ||
| langgraph | ||
|
|
||
| # LLM providers | ||
| groq | ||
| google-generativeai | ||
|
|
||
| # Basic utilities | ||
| numpy | ||
| requests | ||
| httpx No newline at end of file |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Unpinned requirements undermine reproducibility & supply-chain security.
Every docker build may pull different transitive versions, causing “works-on-my-machine” bugs.
Action:
- Pin versions (
fastapi==0.111.0, etc.) - Commit a lock file generated via
pip-compileorpoetry lock.
[tagging follows advice above]
🤖 Prompt for AI Agents
In sentient-core/requirements-minimal.txt lines 1 to 22, the dependencies are
listed without version pins, which risks inconsistent builds and supply-chain
security issues. Fix this by specifying exact versions for each package using
the == operator, for example, fastapi==0.111.0. Additionally, generate and
commit a lock file using a tool like pip-compile or poetry lock to ensure
reproducible installs with fixed transitive dependencies.
| #!/bin/bash | ||
|
|
||
| # Script to install optional dependencies at runtime | ||
| # This allows the container to start quickly and install heavy dependencies only when needed | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Add strict-mode guards up-front.
Without set -euo pipefail the script will silently continue on failed pip commands or unset variables, masking issues during image builds or runtime execution.
#!/bin/bash
+set -euo pipefail🤖 Prompt for AI Agents
In sentient-core/install-optional-deps.sh at the beginning of the script (lines
1 to 5), add the strict-mode guards by including the line 'set -euo pipefail'
right after the shebang. This will ensure the script exits immediately on
errors, treats unset variables as errors, and fails on pipeline errors,
preventing silent failures during dependency installation.
| FROM python:3.11-slim | ||
|
|
||
| WORKDIR /app | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Expose the PIP_DEFAULT_TIMEOUT build-arg that compose passes in.
docker-compose.alt.yml provides the argument, but the Dockerfile never declares or uses it, so the value is silently ignored.
FROM python:3.11-slim
+ARG PIP_DEFAULT_TIMEOUT=60
+ENV PIP_DEFAULT_TIMEOUT=${PIP_DEFAULT_TIMEOUT}
WORKDIR /app📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| FROM python:3.11-slim | |
| WORKDIR /app | |
| FROM python:3.11-slim | |
| ARG PIP_DEFAULT_TIMEOUT=60 | |
| ENV PIP_DEFAULT_TIMEOUT=${PIP_DEFAULT_TIMEOUT} | |
| WORKDIR /app |
🤖 Prompt for AI Agents
In sentient-core/Dockerfile.alt at lines 1 to 4, the Dockerfile does not declare
or use the build argument PIP_DEFAULT_TIMEOUT that docker-compose.alt.yml passes
in. Add a build-arg declaration for PIP_DEFAULT_TIMEOUT near the top of the
Dockerfile and use it to set the environment variable or configure pip
accordingly so the value is not ignored during the build.
| RUN poetry config virtualenvs.create false && \ | ||
| poetry config installer.max-workers 10 && \ | ||
| poetry config installer.parallel false && \ | ||
| poetry config http-basic.pypi --force-unsigned-protocol && \ | ||
| poetry config --list | ||
|
|
There was a problem hiding this comment.
Avoid disabling Poetry’s TLS verification – introduces serious supply-chain risk
poetry config http-basic.pypi --force-unsigned-protocol silently downgrades the PyPI transport to plain HTTP. Combined with the later PYTHONHTTPSVERIFY=0, the build will happily fetch unsigned packages over an un-encrypted channel, opening the door to MITM package poisoning. Remove this line and rely on the normal HTTPS index or a private mirror that supports TLS.
🤖 Prompt for AI Agents
In sentient-core/Dockerfile around lines 18 to 23, remove the line that sets
`poetry config http-basic.pypi --force-unsigned-protocol` because it disables
TLS verification and downgrades PyPI transport to plain HTTP, which is a
security risk. Instead, rely on the default HTTPS connection or use a private
mirror that supports TLS to ensure secure package fetching.
| RUN --mount=type=cache,target=/root/.cache/pypoetry \ | ||
| pip install --upgrade pip && \ | ||
| pip install urllib3==2.0.7 requests==2.31.0 && \ | ||
| export PYTHONHTTPSVERIFY=0 && \ | ||
| for i in $(seq 1 3); do \ | ||
| echo "Attempt $i: Installing dependencies..." && \ | ||
| poetry install --no-interaction --no-ansi --no-root --with dev && \ | ||
| if [ $? -eq 0 ]; then \ | ||
| break; \ | ||
| fi; \ | ||
| echo "Attempt $i failed, retrying..." && \ | ||
| sleep 5; \ | ||
| done |
There was a problem hiding this comment.
PYTHONHTTPSVERIFY=0 disables all cert checks – insecure & violates CKV2_DOCKER_5
Exporting PYTHONHTTPSVERIFY=0 turns off certificate validation for every subsequent HTTPS request executed by pip inside the image and by your app at runtime. That’s rarely justifiable. If you only need this during the build (e.g., behind an intercepting proxy), use a build-time ARG and unset it afterwards:
- export PYTHONHTTPSVERIFY=0 && \
+ # Uncomment only if your corporate proxy re-signs certs
+# export PYTHONHTTPSVERIFY=0 && \or inject a proper CA bundle instead.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| RUN --mount=type=cache,target=/root/.cache/pypoetry \ | |
| pip install --upgrade pip && \ | |
| pip install urllib3==2.0.7 requests==2.31.0 && \ | |
| export PYTHONHTTPSVERIFY=0 && \ | |
| for i in $(seq 1 3); do \ | |
| echo "Attempt $i: Installing dependencies..." && \ | |
| poetry install --no-interaction --no-ansi --no-root --with dev && \ | |
| if [ $? -eq 0 ]; then \ | |
| break; \ | |
| fi; \ | |
| echo "Attempt $i failed, retrying..." && \ | |
| sleep 5; \ | |
| done | |
| RUN --mount=type=cache,target=/root/.cache/pypoetry \ | |
| pip install --upgrade pip && \ | |
| pip install urllib3==2.0.7 requests==2.31.0 && \ | |
| # Uncomment only if your corporate proxy re-signs certs | |
| # export PYTHONHTTPSVERIFY=0 && \ | |
| for i in $(seq 1 3); do \ | |
| echo "Attempt $i: Installing dependencies..." && \ | |
| poetry install --no-interaction --no-ansi --no-root --with dev && \ | |
| if [ $? -eq 0 ]; then \ | |
| break; \ | |
| fi; \ | |
| echo "Attempt $i failed, retrying..." && \ | |
| sleep 5; \ | |
| done |
🧰 Tools
🪛 Checkov (3.2.334)
[HIGH] 28-40: Ensure that certificate validation isn't disabled with the PYTHONHTTPSVERIFY environmnet variable
(CKV2_DOCKER_5)
🤖 Prompt for AI Agents
In sentient-core/Dockerfile around lines 28 to 40, the use of "export
PYTHONHTTPSVERIFY=0" disables HTTPS certificate verification globally, which is
insecure and violates best practices. To fix this, replace the export with a
build-time ARG that sets PYTHONHTTPSVERIFY=0 only during the build step if
necessary, and ensure it is unset or not present in the final image.
Alternatively, configure the image to use a proper CA bundle for certificate
verification instead of disabling it.
| volumes: | ||
| - .:/app # Mount the entire project for hot reloading | ||
| - ./.env:/app/.env | ||
| restart: unless-stopped |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Prefer env_file: over bind-mounting a .env – avoids host-path leakage
Mounting .env as a volume ties the container to a host-specific absolute path and risks exposing secrets if the compose file is reused elsewhere. Switching to the native env_file: directive is cleaner:
environment:
- PYTHONUNBUFFERED=1
...
env_file: .env
volumes:
- .:/app🤖 Prompt for AI Agents
In sentient-core/docker-compose.dev.yml around lines 20 to 23, the .env file is
currently bind-mounted as a volume, which risks exposing secrets and ties the
container to a host-specific path. To fix this, remove the volume mount for .env
and instead use the env_file: directive pointing to .env. Keep the other volume
mounts intact and add any necessary environment variables under environment: as
needed.
| volumes: | ||
| - ./.env:/app/.env | ||
| - ./memory_management.db:/app/memory_management.db | ||
| - ./memory_vectors:/app/memory_vectors | ||
| restart: unless-stopped |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Same .env bind-mount issue as dev compose
Using env_file: .env improves portability and keeps secrets management declarative. See previous comment for diff example.
🤖 Prompt for AI Agents
In sentient-core/docker-compose.yml around lines 20 to 24, the .env file is
bind-mounted using volumes, which is less portable and mixes secrets management
with file mounting. Replace the volume mount of .env with the env_file: .env
directive to declaratively specify environment variables, improving portability
and secrets handling.
| The following data is persisted through Docker volumes: | ||
| - SQLite database files | ||
| - Vector database files | ||
| - Environment variables | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Environment variables are not persisted via Docker volumes
The list claims that “Environment variables” are persisted through volumes, which is inaccurate—env-file values are injected at container start but are not stored inside a volume.
Persisting secrets generally requires an external secrets manager or Docker secrets, not a volume.
Please revise this item (or remove it) to avoid misleading operators.
🤖 Prompt for AI Agents
In sentient-core/DOCKER.md around lines 166 to 170, the documentation
incorrectly states that environment variables are persisted through Docker
volumes. Update this section to remove "Environment variables" from the list of
data persisted via volumes, clarifying that environment variables are injected
at container start and not stored in volumes. Optionally, add a note that
persisting secrets requires external secrets managers or Docker secrets instead
of volumes.
2 participants
Docker set-up and resolving typescrip issues
Summary by CodeRabbit
New Features
Documentation
Chores
.gitignoreto exclude environment files.Refactor