okengine 0.11.2 → 0.13.0

package/src/docker/postgres-advisor.integration.test.ts

@@ -0,0 +1,163 @@
+/**
+ * Integration: opt-in postgres-advisor image builds and Index Advisor works.
+ *
+ * Opt-in via `OKE_TEST_DOCKER=1` plus a live Docker daemon. Never an empty pass.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  deriveInfrastructure,
+  POSTGRES_ADVISOR_DOCKERFILE,
+  POSTGRES_ADVISOR_IMAGE,
+  writeDerivedFiles,
+} from "./index.ts";
+
+function dockerAvailable(): boolean {
+  try {
+    return Bun.spawnSync(["docker", "info"], { stdout: "pipe", stderr: "pipe" }).exitCode === 0;
+  } catch {
+    return false;
+  }
+}
+
+const WANT = process.env.OKE_TEST_DOCKER === "1";
+const DOCKER = WANT && dockerAvailable();
+if (!DOCKER) {
+  console.log(
+    WANT
+      ? "skip: postgres-advisor e2e (docker daemon not available)"
+      : "skip: postgres-advisor e2e (OKE_TEST_DOCKER≠1)",
+  );
+}
+const live = DOCKER ? test : test.skip;
+
+describe("postgres-advisor integration", () => {
+  live(
+    "builds the advisor image and index_advisor returns CREATE INDEX",
+    async () => {
+      const dir = await mkdtemp(join(tmpdir(), "oke-pg-advisor-"));
+      const imageTag = `oke-postgres-advisor-test:${Date.now()}`;
+      const container = `oke-pg-advisor-${Date.now()}`;
+      try {
+        const derived = deriveInfrastructure({
+          images: { "store.sql": POSTGRES_ADVISOR_IMAGE },
+          credentials: {
+            "store.sql": { user: "oke", password: "advisor-test-pw", database: "oke" },
+          },
+        });
+        await writeDerivedFiles(derived, dir);
+        const dockerfile = join(dir, POSTGRES_ADVISOR_DOCKERFILE);
+        const build = Bun.spawnSync(["docker", "build", "-t", imageTag, "-f", dockerfile, dir], {
+          stdout: "pipe",
+          stderr: "pipe",
+        });
+        expect(build.exitCode).toBe(0);
+
+        const run = Bun.spawnSync(
+          [
+            "docker",
+            "run",
+            "-d",
+            "--name",
+            container,
+            "-e",
+            "POSTGRES_PASSWORD=advisor-test-pw",
+            "-e",
+            "POSTGRES_USER=oke",
+            "-e",
+            "POSTGRES_DB=oke",
+            imageTag,
+            "postgres",
+            "-c",
+            "shared_preload_libraries=pg_stat_statements",
+          ],
+          { stdout: "pipe", stderr: "pipe" },
+        );
+        expect(run.exitCode).toBe(0);
+
+        let ready = false;
+        for (let i = 0; i < 40; i++) {
+          const ping = Bun.spawnSync(
+            ["docker", "exec", container, "pg_isready", "-U", "oke", "-d", "oke"],
+            { stdout: "pipe", stderr: "pipe" },
+          );
+          if (ping.exitCode === 0) {
+            ready = true;
+            break;
+          }
+          await Bun.sleep(500);
+        }
+        expect(ready).toBe(true);
+
+        const ext = Bun.spawnSync(
+          [
+            "docker",
+            "exec",
+            container,
+            "psql",
+            "-U",
+            "oke",
+            "-d",
+            "oke",
+            "-v",
+            "ON_ERROR_STOP=1",
+            "-c",
+            "CREATE EXTENSION index_advisor CASCADE;",
+          ],
+          { stdout: "pipe", stderr: "pipe" },
+        );
+        expect(ext.exitCode).toBe(0);
+
+        const setup = Bun.spawnSync(
+          [
+            "docker",
+            "exec",
+            container,
+            "psql",
+            "-U",
+            "oke",
+            "-d",
+            "oke",
+            "-v",
+            "ON_ERROR_STOP=1",
+            "-c",
+            "CREATE TABLE bookings (id int, email text);",
+          ],
+          { stdout: "pipe", stderr: "pipe" },
+        );
+        expect(setup.exitCode).toBe(0);
+
+        const advise = Bun.spawnSync(
+          [
+            "docker",
+            "exec",
+            container,
+            "psql",
+            "-U",
+            "oke",
+            "-d",
+            "oke",
+            "-v",
+            "ON_ERROR_STOP=1",
+            "-t",
+            "-A",
+            "-c",
+            "SELECT index_statements FROM index_advisor('SELECT * FROM bookings WHERE email = $1');",
+          ],
+          { stdout: "pipe", stderr: "pipe" },
+        );
+        expect(advise.exitCode).toBe(0);
+        const out = new TextDecoder().decode(advise.stdout);
+        expect(out.toLowerCase()).toContain("create index");
+      } finally {
+        Bun.spawnSync(["docker", "rm", "-f", container], { stdout: "pipe", stderr: "pipe" });
+        Bun.spawnSync(["docker", "rmi", "-f", imageTag], { stdout: "pipe", stderr: "pipe" });
+        await rm(dir, { recursive: true, force: true });
+      }
+    },
+    600_000,
+  );
+});

package/src/docker/query-passthrough.integration.test.ts

@@ -0,0 +1,212 @@
+/**
+ * QUERY method passthrough through real Caddy and Traefik binaries.
+ *
+ * Uses HTTP-only configs that reuse the recipe reverse_proxy / loadbalancer
+ * primitives (production recipes terminate TLS). Opt-in via `OKE_TEST_DOCKER=1`.
+ */
+
+import { afterAll, describe, expect, test } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+function dockerAvailable(): boolean {
+  try {
+    return Bun.spawnSync(["docker", "info"], { stdout: "pipe", stderr: "pipe" }).exitCode === 0;
+  } catch {
+    return false;
+  }
+}
+
+const WANT = process.env.OKE_TEST_DOCKER === "1";
+const DOCKER = WANT && dockerAvailable();
+if (!DOCKER) {
+  console.log(
+    WANT
+      ? "skip: QUERY proxy passthrough (docker daemon not available)"
+      : "skip: QUERY proxy passthrough (OKE_TEST_DOCKER≠1)",
+  );
+}
+const live = DOCKER ? test : test.skip;
+
+const QUERY_BODY = { n: 7 } as const;
+
+async function waitFor(
+  url: string,
+  init: RequestInit,
+  attempts = 40,
+): Promise<Response | undefined> {
+  for (let i = 0; i < attempts; i++) {
+    try {
+      const res = await fetch(url, init);
+      if (res.status !== 502 && res.status !== 503) return res;
+    } catch {
+      // proxy not ready
+    }
+    await Bun.sleep(250);
+  }
+  return undefined;
+}
+
+async function dockerPort(name: string, containerPort: string): Promise<string> {
+  const proc = Bun.spawn(["docker", "port", name, containerPort], {
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  const out = await new Response(proc.stdout).text();
+  await proc.exited;
+  const m = out.match(/:(\d+)/);
+  if (!m?.[1]) {
+    throw new Error(`docker port ${name} ${containerPort}: ${out}`);
+  }
+  return m[1];
+}
+
+async function dockerRm(name: string): Promise<void> {
+  await Bun.spawn(["docker", "rm", "-f", name], {
+    stdout: "pipe",
+    stderr: "pipe",
+  }).exited;
+}
+
+describe("QUERY passthrough — Caddy + Traefik", () => {
+  const names: string[] = [];
+  let echo: ReturnType<typeof Bun.serve> | undefined;
+
+  afterAll(async () => {
+    echo?.stop();
+    await Promise.all(names.map((n) => dockerRm(n)));
+  });
+
+  live(
+    "Caddy reverse_proxy and Traefik loadbalancer forward QUERY with a JSON body",
+    async () => {
+      echo = Bun.serve({
+        hostname: "0.0.0.0",
+        port: 0,
+        async fetch(request) {
+          let body: unknown;
+          try {
+            body = await request.json();
+          } catch {
+            body = null;
+          }
+          return Response.json({ method: request.method, body });
+        },
+      });
+      const upstream = echo.port;
+      const dir = await mkdtemp(join(tmpdir(), "oke-query-proxy-"));
+      const stamp = Date.now();
+
+      try {
+        const caddyfile = [
+          "http://:80 {",
+          `	reverse_proxy host.docker.internal:${upstream}`,
+          "}",
+          "",
+        ].join("\n");
+        const caddyPath = join(dir, "Caddyfile");
+        await Bun.write(caddyPath, caddyfile);
+
+        const traefikYml = [
+          "http:",
+          "  routers:",
+          "    app:",
+          "      rule: PathPrefix(`/`)",
+          "      entryPoints:",
+          "        - web",
+          "      service: app",
+          "  services:",
+          "    app:",
+          "      loadBalancer:",
+          "        servers:",
+          `          - url: http://host.docker.internal:${upstream}`,
+          "",
+        ].join("\n");
+        const traefikPath = join(dir, "traefik.yml");
+        await Bun.write(traefikPath, traefikYml);
+
+        const caddyName = `oke-query-caddy-${stamp}`;
+        const traefikName = `oke-query-traefik-${stamp}`;
+        names.push(caddyName, traefikName);
+
+        const caddyRun = Bun.spawn(
+          [
+            "docker",
+            "run",
+            "-d",
+            "--name",
+            caddyName,
+            "-p",
+            "0:80",
+            "--add-host",
+            "host.docker.internal:host-gateway",
+            "-v",
+            `${caddyPath}:/etc/caddy/Caddyfile:ro`,
+            "caddy:2-alpine",
+          ],
+          { stdout: "pipe", stderr: "pipe" },
+        );
+        const [, caddyErr, caddyCode] = await Promise.all([
+          new Response(caddyRun.stdout).text(),
+          new Response(caddyRun.stderr).text(),
+          caddyRun.exited,
+        ]);
+        expect(caddyCode).toBe(0);
+        if (caddyCode !== 0) console.error(caddyErr);
+
+        const traefikRun = Bun.spawn(
+          [
+            "docker",
+            "run",
+            "-d",
+            "--name",
+            traefikName,
+            "-p",
+            "0:80",
+            "--add-host",
+            "host.docker.internal:host-gateway",
+            "-v",
+            `${traefikPath}:/etc/traefik/dynamic.yml:ro`,
+            "traefik:v3.7",
+            "--entrypoints.web.address=:80",
+            "--providers.file.filename=/etc/traefik/dynamic.yml",
+            "--ping=true",
+          ],
+          { stdout: "pipe", stderr: "pipe" },
+        );
+        const [, traefikErr, traefikCode] = await Promise.all([
+          new Response(traefikRun.stdout).text(),
+          new Response(traefikRun.stderr).text(),
+          traefikRun.exited,
+        ]);
+        expect(traefikCode).toBe(0);
+        if (traefikCode !== 0) console.error(traefikErr);
+
+        const caddyPort = await dockerPort(caddyName, "80");
+        const traefikPort = await dockerPort(traefikName, "80");
+        const init: RequestInit = {
+          method: "QUERY",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify(QUERY_BODY),
+        };
+
+        const caddyRes = await waitFor(`http://127.0.0.1:${caddyPort}/q`, init);
+        expect(caddyRes).toBeDefined();
+        expect(caddyRes!.status).toBe(200);
+        expect(await caddyRes!.json()).toEqual({ method: "QUERY", body: QUERY_BODY });
+
+        const traefikRes = await waitFor(`http://127.0.0.1:${traefikPort}/q`, init);
+        expect(traefikRes).toBeDefined();
+        expect(traefikRes!.status).toBe(200);
+        expect(await traefikRes!.json()).toEqual({ method: "QUERY", body: QUERY_BODY });
+      } finally {
+        echo.stop();
+        echo = undefined;
+        await Promise.all(names.splice(0).map((n) => dockerRm(n)));
+        await rm(dir, { recursive: true, force: true }).catch(() => {});
+      }
+    },
+    180_000,
+  );
+});

package/src/docker/recipes/dragonfly.ts

@@ -5,6 +5,7 @@
  * Official image: `docker.dragonflydb.io/dragonflydb/dragonfly`.
  */
 
+import { dragonflyServerCommand } from "../helpers.ts";
 import type { ImageRecipe } from "../types.ts";
 
 /** Dragonfly — Redis protocol on 6379. */
@@ -12,13 +13,9 @@ export const dragonfly: ImageRecipe = {
   id: "dragonfly",
   port: 6379,
   match: (i) => /dragonfly/i.test(i),
-  apply: () => ({
+  apply: (s) => ({
     environment: { HEALTHCHECK_PORT: "6379" },
-    command: [
-      "sh",
-      "-c",
-      'exec dragonfly --requirepass "$$OKE_STORE_KV_PASSWORD" --maxmemory "$${OKE_STORE_KV_MAXMEMORY:-0}"',
-    ],
+    command: ["sh", "-c", dragonflyServerCommand(s)],
     ulimits: { memlock: -1 },
     healthcheck: {
       test: ["CMD", "/usr/local/bin/healthcheck.sh"],

package/src/docker/recipes/index.ts

@@ -9,8 +9,10 @@ import { dragonfly } from "./dragonfly.ts";
 import { llamaCpp } from "./llama-cpp.ts";
 import { mailpit } from "./mailpit.ts";
 import { meilisearch } from "./meilisearch.ts";
+import { nginx } from "./nginx.ts";
 import { ollama } from "./ollama.ts";
 import { pgdog } from "./pgdog.ts";
+import { postgresAdvisor } from "./postgres-advisor.ts";
 import { postgres } from "./postgres.ts";
 import { redis } from "./redis.ts";
 import { rustfs } from "./rustfs.ts";
@@ -28,6 +30,7 @@ export const builtinRecipes: readonly ImageRecipe[] = [
   yugabyte,
   timescale,
   supabase,
+  postgresAdvisor,
   postgres,
   pgdog,
   dragonfly,
@@ -41,6 +44,7 @@ export const builtinRecipes: readonly ImageRecipe[] = [
   sglang,
   ollama,
   caddy,
+  nginx,
   traefik,
 ];
 
@@ -51,9 +55,11 @@ export {
   llamaCpp,
   mailpit,
   meilisearch,
+  nginx,
   ollama,
   pgdog,
   postgres,
+  postgresAdvisor,
   redis,
   rustfs,
   sglang,
@@ -76,6 +82,13 @@ export {
 export { OLLAMA_IMAGE, OLLAMA_MIN_SAFE_VERSION } from "./ollama.ts";
 export { SGLANG_IMAGE } from "./sglang.ts";
 export { VLLM_IMAGE } from "./vllm.ts";
+export {
+  emitPostgresAdvisorDockerfile,
+  HYPOPG_GIT_TAG,
+  INDEX_ADVISOR_GIT_TAG,
+  POSTGRES_ADVISOR_DOCKERFILE,
+  POSTGRES_ADVISOR_IMAGE,
+} from "./postgres-advisor.ts";
 
 /**
  * Resolve the recipe for an image reference.

package/src/docker/recipes/llama-cpp.ts

@@ -23,7 +23,7 @@ import type { ImageRecipe } from "../types.ts";
 export const LLAMA_CPP_MIN_SAFE_BUILD = 8146;
 
 /** Pinned default image — verified ≥ {@link LLAMA_CPP_MIN_SAFE_BUILD}; never `latest`. */
-export const LLAMA_CPP_IMAGE = "ghcr.io/ggml-org/llama.cpp:server-b10290";
+export const LLAMA_CPP_IMAGE = "ghcr.io/ggml-org/llama.cpp:server-b10450";
 
 /**
  * Basename of the generated entrypoint.
@@ -242,7 +242,7 @@ def main() -> None:
     # KV cache for that is allocated up front and can be many times the
     # model's own file size, OOM-killing the container even with generous
     # Docker memory — independent of how small the model itself is.
-    # OKE_AI_CTX_SIZE (docker/.env.docker) overrides this default.
+    # OKE_AI_CTX_SIZE (.env.local) overrides this default.
     ctx_size = (os.environ.get("OKE_AI_CTX_SIZE") or "4096").strip() or "4096"
     print(f"oke ai: serving {model} from {gguf} (ctx={ctx_size})", flush=True)
     os.execv(
@@ -274,7 +274,7 @@ export const llamaCpp: ImageRecipe = {
   port: 8080,
   match: (i) => /llama\.cpp|llamacpp/i.test(i),
   apply: (s) => ({
-    // OKE_AI_MODEL comes from compose `env_file` (`.env.docker`). Do not
+    // OKE_AI_MODEL comes from compose `env_file` (`.env.local`). Do not
     // re-declare it as `${OKE_AI_MODEL:-granite3.3:2b}` here — Compose interpolates
     // that from the *host* shell and can override the stack file with the
     // default. Never set LLAMA_ARG_MODELS_PRESET / LLAMA_ARG_DOCKER_REPO

package/src/docker/recipes/nginx.ts

@@ -0,0 +1,61 @@
+/**
+ * nginx image recipe — static reverse proxy via a generated `nginx.conf`.
+ *
+ * Opt-in via `images.proxy`. HTTP edge on :80; put Cloudflare / ALB / another
+ * TLS terminator in front, or prefer Caddy / Traefik for automatic HTTPS.
+ */
+
+import { APP_PORT } from "../../runtime/types.ts";
+import type { ImageRecipe } from "../types.ts";
+
+/** Compose service name for the application container. */
+export const NGINX_APP_SERVICE = "app";
+
+/**
+ * Build a minimal nginx.conf — reverse-proxy to the compose `app` service.
+ *
+ * @param opts - Upstream app port on the compose network
+ */
+export function buildNginxConf(opts: { readonly appPort?: number } = {}): string {
+  const port = opts.appPort ?? APP_PORT;
+  return [
+    "# Generated by `oke docker` — edit via compose.override.yml / replace this file.",
+    "events { worker_connections 1024; }",
+    "http {",
+    "	upstream oke_app {",
+    `		server ${NGINX_APP_SERVICE}:${port};`,
+    "	}",
+    "	server {",
+    "		listen 80;",
+    "		server_name _;",
+    "		location / {",
+    "			proxy_pass http://oke_app;",
+    "			proxy_http_version 1.1;",
+    "			proxy_set_header Host $host;",
+    "			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;",
+    "			proxy_set_header X-Forwarded-Proto $scheme;",
+    "			proxy_set_header Upgrade $http_upgrade;",
+    "			proxy_set_header Connection $http_connection;",
+    "		}",
+    "	}",
+    "}",
+    "",
+  ].join("\n");
+}
+
+/** nginx reverse proxy. HTTP 80 (TLS via an outer edge or switch to Caddy). */
+export const nginx: ImageRecipe = {
+  id: "nginx",
+  port: 80,
+  match: (i) => /nginx/i.test(i),
+  apply: () => ({
+    volumes: ["./nginx.conf:/etc/nginx/nginx.conf:ro"],
+    healthcheck: {
+      test: ["CMD", "nginx", "-t"],
+      interval: "10s",
+      timeout: "3s",
+      retries: 5,
+    },
+  }),
+  url: (_s, c) => `http://${c.host}`,
+};

package/src/docker/recipes/ollama.ts

@@ -16,7 +16,7 @@ import type { ImageRecipe } from "../types.ts";
 export const OLLAMA_MIN_SAFE_VERSION = "0.17.1";
 
 /** Pinned default Ollama image — verified ≥ {@link OLLAMA_MIN_SAFE_VERSION}; never `latest`. */
-export const OLLAMA_IMAGE = "ollama/ollama:0.32.6";
+export const OLLAMA_IMAGE = "ollama/ollama:0.32.13";
 
 /** Ollama local model server. API on 11434; loopback publish only. */
 export const ollama: ImageRecipe = {

package/src/docker/recipes/postgres-advisor.ts

@@ -0,0 +1,58 @@
+/**
+ * Opt-in Postgres image with hypopg + index_advisor (PGXS).
+ *
+ * Pin `oke-postgres-advisor:18-alpine` — do not change the default
+ * `postgres:18-alpine` pull. Driver id stays `postgres`.
+ */
+
+import { POSTGRES_STAT_STATEMENTS_COMMAND, postgresEnv, postgresHealth } from "../helpers.ts";
+import type { ImageRecipe } from "../types.ts";
+
+/** Compose-dir Dockerfile name emitted by `oke docker`. */
+export const POSTGRES_ADVISOR_DOCKERFILE = "Dockerfile.postgres-advisor";
+
+/** Local image tag operators pin as `images["store.sql"]`. */
+export const POSTGRES_ADVISOR_IMAGE = "oke-postgres-advisor:18-alpine";
+
+/** HypoPG git tag (C/PGXS). */
+export const HYPOPG_GIT_TAG = "1.4.1";
+
+/** index_advisor git tag (DATA-only PGXS). */
+export const INDEX_ADVISOR_GIT_TAG = "0.2.0";
+
+/**
+ * Dockerfile that extends official Alpine Postgres with advisor extensions.
+ *
+ * @param baseImage - Official postgres alpine tag
+ */
+export function emitPostgresAdvisorDockerfile(baseImage: string = "postgres:18-alpine"): string {
+  return `# generated by oke docker — do not edit
+FROM ${baseImage}
+ARG DOCKER_PG_LLVM_DEPS="llvm19-dev clang19"
+RUN apk add --no-cache --virtual .build-deps \\
+      $DOCKER_PG_LLVM_DEPS \\
+      build-base \\
+      git \\
+    && git clone --depth 1 --branch ${HYPOPG_GIT_TAG} https://github.com/HypoPG/hypopg.git /tmp/hypopg \\
+    && make -C /tmp/hypopg && make -C /tmp/hypopg install \\
+    && git clone --depth 1 --branch ${INDEX_ADVISOR_GIT_TAG} https://github.com/supabase/index_advisor.git /tmp/index_advisor \\
+    && make -C /tmp/index_advisor install \\
+    && apk del --no-network .build-deps \\
+    && rm -rf /tmp/hypopg /tmp/index_advisor
+`;
+}
+
+/** Opt-in advisor Postgres — matched ahead of generic postgres. */
+export const postgresAdvisor: ImageRecipe = {
+  id: "postgres-advisor",
+  port: 5432,
+  match: (i) => /oke-postgres-advisor|postgres-advisor/i.test(i),
+  apply: (s) => ({
+    environment: postgresEnv(s),
+    healthcheck: postgresHealth,
+    command: [...POSTGRES_STAT_STATEMENTS_COMMAND],
+    build: { context: ".", dockerfile: POSTGRES_ADVISOR_DOCKERFILE },
+  }),
+  url: (_s, c) =>
+    `postgres://${c.user}:${encodeURIComponent(c.password)}@${c.host}:${c.port}/${c.database}`,
+};

package/src/docker/recipes/postgres.ts

@@ -2,7 +2,7 @@
  * Postgres / pgvector image recipe (≤15 lines of recipe body).
  */
 
-import { postgresEnv, postgresHealth } from "../helpers.ts";
+import { POSTGRES_STAT_STATEMENTS_COMMAND, postgresEnv, postgresHealth } from "../helpers.ts";
 import type { ImageRecipe } from "../types.ts";
 
 /** Postgres-protocol servers (Postgres · pgvector). Timescale / Supabase match first. */
@@ -10,7 +10,11 @@ export const postgres: ImageRecipe = {
   id: "postgres",
   port: 5432,
   match: (i) => /postgres|pgvector/i.test(i),
-  apply: (s) => ({ environment: postgresEnv(s), healthcheck: postgresHealth }),
+  apply: (s) => ({
+    environment: postgresEnv(s),
+    healthcheck: postgresHealth,
+    command: [...POSTGRES_STAT_STATEMENTS_COMMAND],
+  }),
   url: (_s, c) =>
     `postgres://${c.user}:${encodeURIComponent(c.password)}@${c.host}:${c.port}/${c.database}`,
 };

package/src/docker/recipes/redis.ts

@@ -5,7 +5,7 @@
  * `redis://` URL, different binaries. Pin via `images["store.kv"]`.
  */
 
-import { credEnv } from "../helpers.ts";
+import { credEnv, kvServerCommand } from "../helpers.ts";
 import type { ImageRecipe } from "../types.ts";
 
 /** Redis Open Source — Redis protocol on 6379. */
@@ -14,11 +14,7 @@ export const redis: ImageRecipe = {
   port: 6379,
   match: (i) => /(?:^|\/)redis(?:[:@/]|$)/i.test(i) || /keydb/i.test(i),
   apply: (s) => ({
-    command: [
-      "sh",
-      "-c",
-      'exec redis-server --requirepass "$$OKE_STORE_KV_PASSWORD" --maxmemory "$${OKE_STORE_KV_MAXMEMORY:-0}" --maxmemory-policy "$${OKE_STORE_KV_MAXMEMORY_POLICY:-noeviction}"',
-    ],
+    command: ["sh", "-c", kvServerCommand(s, "redis-server")],
     healthcheck: {
       test: ["CMD", "redis-cli", "-a", credEnv(s, "PASSWORD"), "ping"],
       interval: "5s",

package/src/docker/recipes/sglang.ts

@@ -10,7 +10,7 @@
 import type { ImageRecipe } from "../types.ts";
 
 /** Pinned SGLang runtime image — never `latest`. */
-export const SGLANG_IMAGE = "lmsysorg/sglang:v0.5.16-runtime";
+export const SGLANG_IMAGE = "lmsysorg/sglang:v0.5.17-runtime";
 
 /** SGLang — OpenAI-compatible HTTP on 30000; GPU reservation; loopback publish. */
 export const sglang: ImageRecipe = {

package/src/docker/recipes/timescale.ts

@@ -4,7 +4,7 @@
  * Driver id stays `postgres`. Matched ahead of the generic Postgres recipe.
  */
 
-import { postgresEnv, postgresHealth } from "../helpers.ts";
+import { TIMESCALE_STAT_STATEMENTS_COMMAND, postgresEnv, postgresHealth } from "../helpers.ts";
 import type { ImageRecipe } from "../types.ts";
 
 /** TimescaleDB — Postgres protocol on 5432. */
@@ -12,7 +12,11 @@ export const timescale: ImageRecipe = {
   id: "timescale",
   port: 5432,
   match: (i) => /timescale/i.test(i),
-  apply: (s) => ({ environment: postgresEnv(s), healthcheck: postgresHealth }),
+  apply: (s) => ({
+    environment: postgresEnv(s),
+    healthcheck: postgresHealth,
+    command: [...TIMESCALE_STAT_STATEMENTS_COMMAND],
+  }),
   url: (_s, c) =>
     `postgres://${c.user}:${encodeURIComponent(c.password)}@${c.host}:${c.port}/${c.database}`,
 };