From c553654aae96cef7f1346fa6124dfe012b0f4d29 Mon Sep 17 00:00:00 2001 From: dschlueter Date: Tue, 7 Jul 2026 10:28:23 +0200 Subject: [PATCH] build(docker): pin the llama.cpp image by digest The :server-cuda tag is a moving target, so a fresh pull could silently change server behaviour (flags, the baked-in healthcheck, ...). Pin the default image to the current digest for reproducibility; overriding `image` in the config or via --image still works. A comment documents how to bump the pin. Co-Authored-By: Claude Opus 4.8 --- docs/SECURITY_AND_OPERATIONS.md | 3 ++- llama.cpp.config.example | 4 +++- src/llamacppctl/config.py | 5 ++++- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/docs/SECURITY_AND_OPERATIONS.md b/docs/SECURITY_AND_OPERATIONS.md index 6d1d2b6..62b1230 100644 --- a/docs/SECURITY_AND_OPERATIONS.md +++ b/docs/SECURITY_AND_OPERATIONS.md @@ -34,7 +34,8 @@ testbar von der Orchestrierung. 1. **Eingebaute Defaults** (`config.builtin_defaults()`) — spiegeln die Standardwerte der ursprünglichen Shell-Skripte wider (Image - `ghcr.io/ggml-org/llama.cpp:server-cuda`, `host_port=8001`, + `ghcr.io/ggml-org/llama.cpp` per Digest gepinnt für Reproduzierbarkeit, + `host_port=8001`, `container_name=va_llm`, `gpu_device=1`, `jinja/fa/kv_unified/ cont_batching/no_context_shift=true`, `reasoning=on`, `cache_type_k/v=q4_0`, `batch_size=1024`, `ubatch_size=512`, diff --git a/llama.cpp.config.example b/llama.cpp.config.example index f9f5e77..628da02 100644 --- a/llama.cpp.config.example +++ b/llama.cpp.config.example @@ -14,7 +14,9 @@ # locking (--change), and --stop/--check targeting. [default] -image = ghcr.io/ggml-org/llama.cpp:server-cuda +# Pinned by digest for reproducibility. The :server-cuda tag is a moving target; +# to update, pull it, read the new digest, and replace the pin below. +image = ghcr.io/ggml-org/llama.cpp@sha256:5535de118ed457f761cbfeacd7e10fef31cb391ca7cac1d5c78b11d28fcf88e6 # hf_home unterstützt Environment-Variablen und ~, z. B. hf_home = ${HF_HOME} hf_home = /srv/models model_path = qwen3/default.gguf diff --git a/src/llamacppctl/config.py b/src/llamacppctl/config.py index 353f910..301ba9a 100644 --- a/src/llamacppctl/config.py +++ b/src/llamacppctl/config.py @@ -36,7 +36,10 @@ class ConfigError(ValueError): def builtin_defaults() -> dict: """Mirrors the original start-llm-server.sh / status-llm-server.sh defaults.""" return { - "image": "ghcr.io/ggml-org/llama.cpp:server-cuda", + # Pinned by digest for reproducibility (the :server-cuda tag is a moving + # target). To update: docker pull ghcr.io/ggml-org/llama.cpp:server-cuda, + # read the new digest, and bump it here (or override `image` in the config). + "image": "ghcr.io/ggml-org/llama.cpp@sha256:5535de118ed457f761cbfeacd7e10fef31cb391ca7cac1d5c78b11d28fcf88e6", "hf_home": "/models", "model_path": "qwen3/default.gguf", "container_name": "va_llm",