okengine 0.18.4 → 0.19.0

package/src/docker/ollama-pull.ts

@@ -1,232 +0,0 @@
-/**
- * Pull an Ollama model via the container's HTTP API on its exposed host port.
- *
- * Never shells out to a host `ollama` CLI — that talks to whichever server wins
- * on the default local port (often a separately installed host daemon), so the
- * model can land outside the recipe container.
- *
- * Skips `/api/pull` when the model is already listed on `/api/tags`.
- */
-
-/** Fetch contract (injectable for tests) — call signature only, not Bun's `preconnect`. */
-export type OllamaFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-
-/** Options for {@link ensureOllamaModel}. */
-export interface EnsureOllamaModelOptions {
-  /** Base URL of the container API, e.g. `http://127.0.0.1:11434`. */
-  readonly url: string;
-  /** Model tag to pull (e.g. `qwen3.5:9b`). */
-  readonly model: string;
-  readonly fetch?: OllamaFetch;
-  /** How long to wait for `/api/tags` before giving up (ms). Default 90s. */
-  readonly readyTimeoutMs?: number;
-  /** Overall pull deadline (ms). Default 20 minutes. */
-  readonly pullTimeoutMs?: number;
-  /** Progress / status lines (e.g. `oke: …`). */
-  readonly onStatus?: (line: string) => void;
-}
-
-/** Fail-loud pull / readiness error. */
-export class OllamaPullError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = "OllamaPullError";
-  }
-}
-
-/**
- * Normalize a base URL (trim trailing slash).
- *
- * @param url - Raw base URL
- */
-export function normalizeOllamaPullUrl(url: string): string {
-  return url.replace(/\/+$/, "");
-}
-
-/**
- * Whether an installed tag covers the requested model id.
- *
- * @param want - Requested id (e.g. `gemma4:e4b`)
- * @param installed - Names from `/api/tags`
- */
-export function ollamaTagsInclude(want: string, installed: readonly string[]): boolean {
-  const id = want.trim();
-  if (!id) return false;
-  const base = id.split(":")[0] ?? id;
-  return installed.some((name) => {
-    if (name === id) return true;
-    if (name.startsWith(`${id}-`)) return true;
-    if (name.startsWith(`${base}:`) && id.startsWith(`${base}:`)) {
-      const instTag = name.slice(base.length + 1);
-      const wantTag = id.slice(base.length + 1);
-      return (
-        instTag === wantTag ||
-        instTag.startsWith(`${wantTag}-`) ||
-        wantTag.startsWith(instTag) ||
-        (instTag === "latest" && wantTag === "latest")
-      );
-    }
-    // bare name matches `name:latest`
-    if (name === `${id}:latest` || id === `${name}:latest`) return true;
-    return false;
-  });
-}
-
-/**
- * Parse model names from an `/api/tags` JSON body.
- *
- * @param json - Parsed response
- */
-export function parseOllamaTagsNames(json: unknown): string[] {
-  if (!json || typeof json !== "object") return [];
-  const models = (json as { models?: unknown }).models;
-  if (!Array.isArray(models)) return [];
-  return models
-    .map((m) =>
-      m && typeof m === "object" && typeof (m as { name?: unknown }).name === "string"
-        ? (m as { name: string }).name
-        : null,
-    )
-    .filter((n): n is string => typeof n === "string" && n.length > 0);
-}
-
-/**
- * Wait until `GET /api/tags` succeeds; skip pull when the model is already
- * present; otherwise `POST /api/pull` with streaming progress.
- *
- * @param opts - Target URL + model (+ optional injectable fetch)
- */
-export async function ensureOllamaModel(opts: EnsureOllamaModelOptions): Promise<void> {
-  const fetchFn = opts.fetch ?? globalThis.fetch;
-  const base = normalizeOllamaPullUrl(opts.url);
-  const model = opts.model.trim();
-  const status = opts.onStatus ?? (() => {});
-  if (!model) throw new OllamaPullError("ollama pull: model id is empty");
-
-  const readyDeadline = Date.now() + (opts.readyTimeoutMs ?? 90_000);
-  let tagsBody: unknown = null;
-  while (Date.now() < readyDeadline) {
-    try {
-      const res = await fetchFn(`${base}/api/tags`, { method: "GET" });
-      if (res.ok) {
-        tagsBody = await res.json().catch(() => null);
-        break;
-      }
-    } catch {
-      // still starting
-    }
-    await Bun.sleep(500);
-  }
-  if (tagsBody === null) {
-    throw new OllamaPullError(`ollama pull: unreachable at ${base}/api/tags`);
-  }
-
-  const installed = parseOllamaTagsNames(tagsBody);
-  if (ollamaTagsInclude(model, installed)) {
-    status(`oke: Ollama already has ${model} at ${base} — skip pull`);
-    return;
-  }
-
-  status(`oke: pulling ${model} into Ollama at ${base}…`);
-
-  const pullDeadline = Date.now() + (opts.pullTimeoutMs ?? 20 * 60_000);
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), Math.max(1, pullDeadline - Date.now()));
-  try {
-    const res = await fetchFn(`${base}/api/pull`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ model, stream: true }),
-      signal: controller.signal,
-    });
-    if (!res.ok) {
-      const text = await res.text().catch(() => "");
-      throw new OllamaPullError(
-        `ollama pull: POST ${base}/api/pull → ${res.status}${text ? ` ${text.slice(0, 200)}` : ""}`,
-      );
-    }
-    await consumeOllamaPullStream(res, status);
-  } catch (err) {
-    if (err instanceof OllamaPullError) throw err;
-    const msg = err instanceof Error ? err.message : String(err);
-    throw new OllamaPullError(`ollama pull: POST ${base}/api/pull failed — ${msg}`);
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-/**
- * Read NDJSON pull progress; surface concise status updates.
- *
- * @param res - Streaming pull response
- * @param status - Status writer
- */
-async function consumeOllamaPullStream(
-  res: Response,
-  status: (line: string) => void,
-): Promise<void> {
-  // Non-body responses (mocked tests) — treat as complete.
-  if (!res.body) {
-    await res.arrayBuffer().catch(() => undefined);
-    return;
-  }
-
-  const reader = res.body.getReader();
-  const decoder = new TextDecoder();
-  let buf = "";
-  const state: PullStreamState = { lastStatus: "", lastPct: -1 };
-
-  for (;;) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    buf += decoder.decode(value, { stream: true });
-    const lines = buf.split("\n");
-    buf = lines.pop() ?? "";
-    for (const line of lines) {
-      handlePullLine(line, status, state);
-    }
-  }
-  buf += decoder.decode();
-  if (buf.trim()) {
-    handlePullLine(buf, status, state);
-  }
-}
-
-type PullStreamState = { lastStatus: string; lastPct: number };
-
-function handlePullLine(
-  line: string,
-  status: (line: string) => void,
-  state: PullStreamState,
-): void {
-  const trimmed = line.trim();
-  if (!trimmed) return;
-  let row: {
-    status?: string;
-    error?: string;
-    completed?: number;
-    total?: number;
-  };
-  try {
-    row = JSON.parse(trimmed) as typeof row;
-  } catch {
-    return;
-  }
-  if (row.error) {
-    throw new OllamaPullError(`ollama pull: ${row.error}`);
-  }
-  const st = row.status?.trim() ?? "";
-  if (typeof row.completed === "number" && typeof row.total === "number" && row.total > 0) {
-    const pct = Math.min(100, Math.floor((100 * row.completed) / row.total));
-    if (pct !== state.lastPct && (pct === 100 || pct - state.lastPct >= 5)) {
-      state.lastPct = pct;
-      status(`oke: Ollama pull ${pct}%${st ? ` (${st})` : ""}`);
-    }
-    return;
-  }
-  if (st && st !== state.lastStatus) {
-    state.lastStatus = st;
-    if (/^pulling\s+[a-f0-9]{12}/i.test(st)) return;
-    status(`oke: Ollama ${st}`);
-  }
-}

package/src/docker/recipes/llama-cpp.ts

@@ -1,298 +0,0 @@
-/**
- * llama.cpp image recipe — default local AI (`ghcr.io/ggml-org/llama.cpp`).
- *
- * OpenAI-compatible `llama-server` on 8080. Pin ≥ {@link LLAMA_CPP_MIN_SAFE_BUILD}
- * (CVE-2026-27940 / CVE-2026-33298 floor). Host publish is loopback-only;
- * never publish RPC. Models via Docker Hub `ai/` — do not load arbitrary
- * untrusted GGUF files.
- *
- * b10290+ issues this recipe works around:
- * 1. Bare `--docker-repo` / router `--models-preset` children re-enter empty
- *    router mode (`is_router_server` only checks `-m` / `-hf`) → forever
- *    `loading`.
- * 2. `llama download -dr` only accepts `application/vnd.docker.ai.gguf.v3`;
- *    newer Hub models (e.g. gemma4) ship `vnd.cncf.model.weight.v1.raw`.
- *
- * Entrypoint: Hub-pull (native download, then CNCF-aware fallback) → serve
- * single-model with `-m` + `--alias`.
- */
-
-import type { ImageRecipe } from "../types.ts";
-
-/** Minimum safe llama.cpp build (GGUF parser CVEs through CVE-2026-27940). */
-export const LLAMA_CPP_MIN_SAFE_BUILD = 8146;
-
-/** Pinned default image — verified ≥ {@link LLAMA_CPP_MIN_SAFE_BUILD}; never `latest`. */
-export const LLAMA_CPP_IMAGE = "ghcr.io/ggml-org/llama.cpp:server-b10450";
-
-/**
- * Basename of the generated entrypoint.
- *
- * Lives under `.oke/` (gitignored generated artefacts), never beside app
- * TypeScript — compose mounts it via {@link LLAMA_CPP_ENTRYPOINT_HOST_PATH}.
- */
-export const LLAMA_CPP_ENTRYPOINT_FILE = "llama-entrypoint.py";
-
-/**
- * Host path relative to the compose directory (`docker/`) for the generated
- * entrypoint. Resolves to `<project>/.oke/llama-entrypoint.py`.
- */
-export const LLAMA_CPP_ENTRYPOINT_HOST_PATH = `../.oke/${LLAMA_CPP_ENTRYPOINT_FILE}`;
-
-/** In-container path for {@link LLAMA_CPP_ENTRYPOINT_FILE}. */
-export const LLAMA_CPP_ENTRYPOINT_MOUNT = "/oke/llama-entrypoint.py";
-
-/**
- * Python entrypoint (runs inside the llama.cpp image, which ships `python3`):
- * pull curated Docker Hub `ai/` GGUF into the cache volume, then `exec`
- * `llama-server -m <gguf> --alias <id>` (single-model, not router).
- *
- * Source of truth is this TypeScript string — the `.py` file is a generated
- * runtime artefact under `.oke/`, not app code.
- */
-export function buildLlamaCppEntrypoint(): string {
-  return `#!/usr/bin/env python3
-# Generated by oke — do not edit. Source: okengine docker llama.cpp recipe.
-"""OKE llama.cpp entrypoint — Hub-pull curated ai/ model, then serve single-model."""
-
-from __future__ import annotations
-
-import json
-import os
-import subprocess
-import sys
-import urllib.error
-import urllib.parse
-import urllib.request
-
-
-def cache_dir() -> str:
-    return os.environ.get("LLAMA_CACHE", "/root/.cache/llama.cpp")
-
-
-def parse_model(model: str) -> tuple[str, str]:
-    raw = model.strip() or "granite3.3:2b"
-    if "/" not in raw.split(":", 1)[0]:
-        raw = f"ai/{raw}"
-    if ":" in raw:
-        repo, tag = raw.rsplit(":", 1)
-    else:
-        repo, tag = raw, "latest"
-    return repo, tag
-
-
-def expected_gguf(repo: str, tag: str) -> str:
-    return f"{repo.replace('/', '_')}_{tag}.gguf"
-
-
-def existing_gguf(path: str) -> str | None:
-    if os.path.isfile(path) and os.path.getsize(path) > 0:
-        return path
-    return None
-
-
-def llama_download(model: str) -> int:
-    return subprocess.call(
-        ["/app/llama", "download", "-dr", model, "--no-mmproj"],
-        stdout=sys.stdout,
-        stderr=sys.stderr,
-    )
-
-
-def registry_token(repo: str) -> str:
-    scope = urllib.parse.quote(f"repository:{repo}:pull", safe="")
-    url = f"https://auth.docker.io/token?service=registry.docker.io&scope={scope}"
-    with urllib.request.urlopen(url, timeout=60) as res:
-        return json.load(res)["token"]
-
-
-def fetch_manifest(repo: str, tag: str, token: str) -> dict:
-    req = urllib.request.Request(
-        f"https://registry-1.docker.io/v2/{repo}/manifests/{tag}",
-        headers={
-            "Authorization": f"Bearer {token}",
-            "Accept": (
-                "application/vnd.oci.image.manifest.v1+json,"
-                "application/vnd.docker.distribution.manifest.v2+json,"
-                "application/vnd.oci.image.index.v1+json,"
-                "application/vnd.docker.distribution.manifest.list.v2+json"
-            ),
-        },
-    )
-    with urllib.request.urlopen(req, timeout=60) as res:
-        return json.load(res)
-
-
-def pick_gguf_layer(manifest: dict) -> tuple[str, str]:
-    """Return (digest, suggested_filename) for the primary GGUF weight layer."""
-    layers = manifest.get("layers") or []
-    candidates: list[tuple[str, str, int]] = []
-    for layer in layers:
-        media = str(layer.get("mediaType") or "")
-        digest = str(layer.get("digest") or "")
-        ann = layer.get("annotations") or {}
-        filepath = str(ann.get("org.cncf.model.filepath") or "")
-        name = filepath.split("/")[-1] if filepath else ""
-        is_gguf = (
-            media == "application/vnd.docker.ai.gguf.v3"
-            or "gguf" in media.lower()
-            or name.lower().endswith(".gguf")
-        )
-        if not is_gguf or not digest:
-            continue
-        if name.lower().startswith("mmproj"):
-            continue
-        size = int(layer.get("size") or 0)
-        candidates.append((digest, name or "model.gguf", size))
-    if not candidates:
-        raise RuntimeError("No GGUF weight layer in Docker / CNCF model manifest")
-    # Prefer the largest non-mmproj GGUF (main weights vs projectors).
-    candidates.sort(key=lambda c: c[2], reverse=True)
-    digest, name, _ = candidates[0]
-    return digest, name
-
-
-def download_blob(repo: str, digest: str, token: str, dest: str) -> None:
-    url = f"https://registry-1.docker.io/v2/{repo}/blobs/{digest}"
-    req = urllib.request.Request(url, headers={"Authorization": f"Bearer {token}"})
-    os.makedirs(os.path.dirname(dest), exist_ok=True)
-    partial = f"{dest}.partial"
-    print(f"oke ai: downloading {digest} → {dest}", flush=True)
-    with urllib.request.urlopen(req, timeout=600) as res, open(partial, "wb") as out:
-        total = int(res.headers.get("Content-Length") or 0)
-        done = 0
-        last_pct = -1
-        while True:
-            chunk = res.read(1024 * 1024)
-            if not chunk:
-                break
-            out.write(chunk)
-            done += len(chunk)
-            if total:
-                pct = (100 * done) // total
-                if pct >= last_pct + 5 or done == total:
-                    last_pct = pct
-                    print(
-                        f"oke ai: download {pct}% ({done // (1024 * 1024)} / {total // (1024 * 1024)} MiB)",
-                        flush=True,
-                    )
-    os.replace(partial, dest)
-
-
-def hub_pull(repo: str, tag: str, dest: str) -> None:
-    token = registry_token(repo)
-    manifest = fetch_manifest(repo, tag, token)
-    # Index → pick first linux manifest if present.
-    if "manifests" in manifest:
-        digests = [m.get("digest") for m in manifest["manifests"] if m.get("digest")]
-        if not digests:
-            raise RuntimeError("Empty OCI index for model")
-        req = urllib.request.Request(
-            f"https://registry-1.docker.io/v2/{repo}/manifests/{digests[0]}",
-            headers={
-                "Authorization": f"Bearer {token}",
-                "Accept": "application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.v2+json",
-            },
-        )
-        with urllib.request.urlopen(req, timeout=60) as res:
-            manifest = json.load(res)
-    digest, _name = pick_gguf_layer(manifest)
-    download_blob(repo, digest, token, dest)
-
-
-def ensure_model(model: str) -> str:
-    repo, tag = parse_model(model)
-    # llama download -dr expects id without forced ai/ prefix when using default org.
-    dr = model.strip() or "granite3.3:2b"
-    if dr.startswith("ai/"):
-        dr = dr[3:]
-    dest = os.path.join(cache_dir(), expected_gguf(repo, tag))
-    hit = existing_gguf(dest)
-    if hit:
-        print(f"oke ai: using cached {hit}", flush=True)
-        return hit
-
-    print(f"oke ai: ensuring Docker Hub model '{dr}' is cached…", flush=True)
-    rc = llama_download(dr)
-    hit = existing_gguf(dest)
-    if hit:
-        return hit
-    # Native downloader may write the same basename; also accept exact path only.
-    print(
-        f"oke ai: native download exit {rc}; trying CNCF / Hub registry pull…",
-        flush=True,
-    )
-    try:
-        hub_pull(repo, tag, dest)
-    except (urllib.error.URLError, urllib.error.HTTPError, TimeoutError, RuntimeError, KeyError, ValueError) as err:
-        print(f"oke ai: failed to download model '{dr}': {err}", file=sys.stderr, flush=True)
-        sys.exit(1)
-    hit = existing_gguf(dest)
-    if not hit:
-        print(f"oke ai: download produced no file at {dest}", file=sys.stderr, flush=True)
-        sys.exit(1)
-    return hit
-
-
-def main() -> None:
-    model = (os.environ.get("OKE_AI_MODEL") or "granite3.3:2b").strip() or "granite3.3:2b"
-    gguf = ensure_model(model)
-    # Without an explicit --ctx-size, llama-server defaults to the model's
-    # full native training context (32K-256K+ for many current models). The
-    # KV cache for that is allocated up front and can be many times the
-    # model's own file size, OOM-killing the container even with generous
-    # Docker memory — independent of how small the model itself is.
-    # OKE_AI_CTX_SIZE (.env.local) overrides this default.
-    ctx_size = (os.environ.get("OKE_AI_CTX_SIZE") or "4096").strip() or "4096"
-    print(f"oke ai: serving {model} from {gguf} (ctx={ctx_size})", flush=True)
-    os.execv(
-        "/app/llama-server",
-        [
-            "/app/llama-server",
-            "--host",
-            "0.0.0.0",
-            "--port",
-            "8080",
-            "--model",
-            gguf,
-            "--alias",
-            model,
-            "--ctx-size",
-            ctx_size,
-        ],
-    )
-
-
-if __name__ == "__main__":
-    main()
-`;
-}
-
-/** llama-server — OpenAI-compatible HTTP on 8080; loopback publish only. */
-export const llamaCpp: ImageRecipe = {
-  id: "llama-cpp",
-  port: 8080,
-  match: (i) => /llama\.cpp|llamacpp/i.test(i),
-  apply: (s) => ({
-    // OKE_AI_MODEL comes from compose `env_file` (`.env.local`). Do not
-    // re-declare it as `${OKE_AI_MODEL:-granite3.3:2b}` here — Compose interpolates
-    // that from the *host* shell and can override the stack file with the
-    // default. Never set LLAMA_ARG_MODELS_PRESET / LLAMA_ARG_DOCKER_REPO
-    // (router children inherit `LLAMA_ARG_*` and can OOM).
-    entrypoint: ["/usr/bin/python3", LLAMA_CPP_ENTRYPOINT_MOUNT],
-    volumes: [
-      `${s.serviceName}-models:/root/.cache`,
-      `${LLAMA_CPP_ENTRYPOINT_HOST_PATH}:${LLAMA_CPP_ENTRYPOINT_MOUNT}:ro`,
-    ],
-    publishBind: "127.0.0.1",
-    healthcheck: {
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/health >/dev/null || exit 1"],
-      interval: "5s",
-      timeout: "5s",
-      retries: 24,
-      // First boot may download a multi‑GB Hub model (CNCF pull) into cache.
-      start_period: "900s",
-    },
-  }),
-  url: (_s, c) => `http://${c.host}:${c.port}/v1`,
-};

package/src/docker/recipes/ollama.ts

@@ -1,44 +0,0 @@
-/**
- * Ollama image recipe — local model server (`ollama/ollama`).
- *
- * Fully supported alternative to the default llama.cpp recipe. Pin ≥
- * {@link OLLAMA_MIN_SAFE_VERSION} (CVE-2026-7482 floor). Host publish is
- * loopback-only — never expose `:11434` on `0.0.0.0`. Load models only from
- * Ollama's library; do not feed arbitrary untrusted GGUF into `/api/create`.
- *
- * Model pull is **not** done here: after compose is up,
- * {@link ensureOllamaModel} POSTs `/api/pull` to this container's loopback URL.
- */
-
-import type { ImageRecipe } from "../types.ts";
-
-/** Minimum safe Ollama release (CVE-2026-7482 — own Go GGUF loader). */
-export const OLLAMA_MIN_SAFE_VERSION = "0.17.1";
-
-/** Pinned default Ollama image — verified ≥ {@link OLLAMA_MIN_SAFE_VERSION}; never `latest`. */
-export const OLLAMA_IMAGE = "ollama/ollama:0.32.13";
-
-/** Ollama local model server. API on 11434; loopback publish only. */
-export const ollama: ImageRecipe = {
-  id: "ollama",
-  port: 11434,
-  match: (i) => /(?:^|\/)ollama(?:[:@/]|$)/i.test(i),
-  apply: (s) => ({
-    environment: {
-      // Listen on all interfaces *inside* the container (Docker networking).
-      // Host publish uses publishBind — never 0.0.0.0 on the host.
-      OLLAMA_HOST: "0.0.0.0:11434",
-      OKE_AI_MODEL: "${OKE_AI_MODEL:-qwen3.5:9b}",
-    },
-    volumes: [`${s.serviceName}-data:/root/.ollama`],
-    publishBind: "127.0.0.1",
-    healthcheck: {
-      test: ["CMD-SHELL", "/bin/ollama list >/dev/null 2>&1 || exit 1"],
-      interval: "5s",
-      timeout: "5s",
-      retries: 24,
-      start_period: "10s",
-    },
-  }),
-  url: (_s, c) => `http://${c.host}:${c.port}`,
-};

package/src/docker/recipes/sglang.ts

@@ -1,55 +0,0 @@
-/**
- * SGLang image recipe — production-tier structured/agent inference.
- *
- * Prefer a managed provider unless you run inference yourself. Use SGLang when
- * the workload is structured generation / agent-heavy on real GPU hardware;
- * use vLLM for general multi-user serving. Pin an explicit tag — never
- * `latest`. Host publish is loopback-only.
- */
-
-import type { ImageRecipe } from "../types.ts";
-
-/** Pinned SGLang runtime image — never `latest`. */
-export const SGLANG_IMAGE = "lmsysorg/sglang:v0.5.17-runtime";
-
-/** SGLang — OpenAI-compatible HTTP on 30000; GPU reservation; loopback publish. */
-export const sglang: ImageRecipe = {
-  id: "sglang",
-  port: 30000,
-  match: (i) => /sglang/i.test(i),
-  apply: (s) => ({
-    command: [
-      "python3",
-      "-m",
-      "sglang.launch_server",
-      "--model-path",
-      "${OKE_AI_MODEL:-Qwen/Qwen3-0.6B}",
-      "--host",
-      "0.0.0.0",
-      "--port",
-      "30000",
-    ],
-    environment: {
-      OKE_AI_MODEL: "${OKE_AI_MODEL:-Qwen/Qwen3-0.6B}",
-      HF_HOME: "/root/.cache/huggingface",
-    },
-    volumes: [`${s.serviceName}-models:/root/.cache/huggingface`],
-    ipc: "host",
-    publishBind: "127.0.0.1",
-    deploy: {
-      resources: {
-        reservations: {
-          devices: [{ driver: "nvidia", count: "all", capabilities: ["gpu"] }],
-        },
-      },
-    },
-    healthcheck: {
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:30000/health >/dev/null || exit 1"],
-      interval: "10s",
-      timeout: "5s",
-      retries: 30,
-      start_period: "120s",
-    },
-  }),
-  url: (_s, c) => `http://${c.host}:${c.port}/v1`,
-};

package/src/docker/recipes/vllm.ts

@@ -1,44 +0,0 @@
-/**
- * vLLM image recipe — production-tier local inference (`vllm/vllm-openai`).
- *
- * OpenAI-compatible server for multi-user GPU concurrency. Prefer a managed
- * provider unless you run inference yourself. Pin an explicit tag — never
- * `latest`. Host publish is loopback-only (same hard rule as llama.cpp).
- */
-
-import type { ImageRecipe } from "../types.ts";
-
-/** Pinned vLLM OpenAI server image — never `latest`. */
-export const VLLM_IMAGE = "vllm/vllm-openai:v0.27.1";
-
-/** vLLM — OpenAI-compatible HTTP on 8000; GPU reservation; loopback publish. */
-export const vllm: ImageRecipe = {
-  id: "vllm",
-  port: 8000,
-  match: (i) => /(?:^|\/)vllm(?:[:@/]|$)/i.test(i),
-  apply: (s) => ({
-    command: ["--model", "${OKE_AI_MODEL:-Qwen/Qwen3-0.6B}", "--host", "0.0.0.0", "--port", "8000"],
-    environment: {
-      OKE_AI_MODEL: "${OKE_AI_MODEL:-Qwen/Qwen3-0.6B}",
-      HF_HOME: "/root/.cache/huggingface",
-    },
-    volumes: [`${s.serviceName}-models:/root/.cache/huggingface`],
-    ipc: "host",
-    publishBind: "127.0.0.1",
-    deploy: {
-      resources: {
-        reservations: {
-          devices: [{ driver: "nvidia", count: "all", capabilities: ["gpu"] }],
-        },
-      },
-    },
-    healthcheck: {
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8000/health >/dev/null || exit 1"],
-      interval: "10s",
-      timeout: "5s",
-      retries: 30,
-      start_period: "120s",
-    },
-  }),
-  url: (_s, c) => `http://${c.host}:${c.port}/v1`,
-};