mirror of
https://github.com/outbackdingo/optimclaw.git
synced 2026-08-25 23:10:11 +00:00
15ab156d62
* feat: add Criterion benchmarks for safety layer hot paths Add benchmark suite using Criterion.rs for performance-critical paths: - benches/safety_check.rs: Sanitizer (clean/adversarial), Validator (normal/long/tool params), LeakDetector (clean/secrets/HTTP scan) - benches/tool_dispatch.rs: JSON parsing, schema validation patterns, tool output serialization CI compiles benchmarks on every PR to prevent regressions. Run locally with: cargo bench Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: add bench-compile to CI roll-up job Include bench-compile in the run-tests roll-up job's needs array so benchmark compilation failures block PRs. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: add black_box to benchmarks, use real SafetyLayer pipeline - Wrap all benchmark inputs in criterion::black_box to prevent compiler optimization from skewing results - Replace generic JSON benchmarks in tool_dispatch.rs with actual SafetyLayer pipeline benchmarks (sanitize_tool_output, wrap_for_llm, scan_inbound_for_secrets) - Keep JSON parsing benchmarks for tool parameter overhead measurement Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: apply cargo fmt to benchmark files Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: copy benches/ in Dockerfile to fix manifest parse error Cargo.toml references [[bench]] targets that must exist for manifest parsing to succeed. Add COPY benches/ to the Docker build stage. Co-Authored-By: Claude Opus 4.6 <[email protected]> * chore: re-trigger CI after adding skip-regression-check label Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address PR review comments on criterion benchmarks - Move header string allocations outside b.iter() closure in http_request_scan to avoid measuring allocation overhead - Add .unwrap() to serde_json::from_str results in JSON parsing benchmarks to catch invalid JSON instead of silently benchmarking error construction - Add comment explaining why benches/ COPY is needed in Dockerfile ([[bench]] entries require source files for cargo manifest parsing) Co-Authored-By: Claude Opus 4.6 <[email protected]> * chore: update Cargo.lock with criterion dependencies Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix(bench): build secret-like strings at runtime to avoid CI secret scanners Construct AWS key and GitHub token patterns via format!() concatenation so the literal strings don't appear in source and trigger push protection or secret scanning in CI pipelines. The resulting strings still match LeakDetector patterns for valid benchmarking. [skip-regression-check] Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: rename tool_dispatch bench, drop async_tokio, replace JSON benchmarks 1. Rename `tool_dispatch.rs` → `safety_pipeline.rs` to match actual content (SafetyLayer pipeline benchmarks). 2. Drop unused `async_tokio` feature from criterion dependency. 3. Replace serde_json::from_str benchmarks (third-party only) with Validator::validate_tool_params exercising IronClaw's recursive validation on simple, complex, and deeply nested JSON inputs. 4. Add `--all-features` to CI bench-compile to match clippy/test convention and verify both DB backends. Addresses zmanian's review feedback on PR #836. Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 <[email protected]>
57 lines
1.4 KiB
Docker
57 lines
1.4 KiB
Docker
# Multi-stage Dockerfile for the IronClaw agent (cloud deployment).
|
|
#
|
|
# Build:
|
|
# docker build --platform linux/amd64 -t ironclaw:latest .
|
|
#
|
|
# Run:
|
|
# docker run --env-file .env -p 3000:3000 ironclaw:latest
|
|
|
|
# Stage 1: Build
|
|
FROM rust:1.92-slim-bookworm AS builder
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
pkg-config libssl-dev cmake gcc g++ \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& rustup target add wasm32-wasip2 \
|
|
&& cargo install wasm-tools
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy manifests first for layer caching
|
|
COPY Cargo.toml Cargo.lock ./
|
|
COPY crates/ crates/
|
|
|
|
# Copy source, build script, tests, and supporting directories
|
|
COPY build.rs build.rs
|
|
COPY src/ src/
|
|
COPY tests/ tests/
|
|
COPY migrations/ migrations/
|
|
COPY registry/ registry/
|
|
COPY channels-src/ channels-src/
|
|
COPY wit/ wit/
|
|
COPY providers.json providers.json
|
|
# [[bench]] entries in Cargo.toml require bench sources to exist for cargo to parse the manifest
|
|
COPY benches/ benches/
|
|
|
|
RUN cargo build --release --bin ironclaw
|
|
|
|
# Stage 2: Runtime
|
|
FROM debian:bookworm-slim
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates libssl3 \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
COPY --from=builder /app/target/release/ironclaw /usr/local/bin/ironclaw
|
|
COPY --from=builder /app/migrations /app/migrations
|
|
|
|
# Non-root user
|
|
RUN useradd -m -u 1000 -s /bin/bash ironclaw
|
|
USER ironclaw
|
|
|
|
EXPOSE 3000
|
|
|
|
ENV RUST_LOG=ironclaw=info
|
|
|
|
ENTRYPOINT ["ironclaw"]
|