Timezone: the container ran in UTC, so mavend answered clock/date queries
(voice.go replySystem) and evaluated quiet-hours (gather.go) in UTC. Fixed at
the root — process TZ — rather than per-call: TZ=Europe/Samara in compose +
tzdata in the image (debian-slim strips it, without which Go ignores TZ and
stays UTC). One knob fixes replies and quiet-hours for every daemon; change the
zone in compose.
Overflow: the dash "ago" helper ran time.Since on a zero timestamp (no presence
yet / fresh db), saturating to ~292y and rendering "2562047h47m…". Guard zero →
"never".
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
build: . lived only on mavend, so `docker compose build mavweb` (or any other
module) silently built nothing and redeployed a stale mavenai:latest — a fixed
binary looked deployed but wasn't. Moved build into the shared anchor; same
image name means it's still built once, but naming any service now rebuilds.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Mapping /dev/dri alone wasn't enough — the container runs as unprivileged
uid 10001, and renderD128 is root:render (mode crw-rw----). Without membership
in the host render gid, Vulkan enumerates zero devices and whisper silently
falls back to CPU. Added group_add 993 (host 'render'); whisper now loads on
RADV RENOIR (AMD Radeon).
Three fixes found bringing the stack up on the host daemon:
- base was golang:1.23-bookworm: bookworm's glibc 2.36 / GLIBCXX 3.4.30 is too
old to link the prebuilt deps/lib/*.so (built on Arch against glibc 2.38 /
GLIBCXX 3.4.32). Moved build+runtime to trixie (glibc 2.40). golang trixie
images start at 1.24, which builds the go 1.23 module fine.
- builder now installs libvulkan-dev — libggml-vulkan.so needs libvulkan.so.1
at link time.
- image renamed maven:latest -> mavenai:latest with pull_policy:never. "maven"
is Apache Maven on Docker Hub; compose was silently pulling it, so every
container ran mvn-entrypoint.sh and exited 127.
Verified on the host: all six build, five-service stack stays up, mavend opens
the encrypted db, mavweb GET :9201 -> 200.
Compose stack replacing start-maven.sh's bare `&`-backgrounded processes.
Single multi-stage image builds all six daemons (CGO + prebuilt native libs
from deps/); compose runs one container each with a different command. Only
mavend mounts the encryption key (env_file, gitignored) and the db volume; the
modules mount just the shared unix-socket dir and read-only models — so the
"key-free modules" boundary is OS-enforced (separate namespaces), not just a
code convention. IPC stays unix-domain over a shared volume: zero code change,
paths move to /run/maven. Encrypted db at rest on a named volume, decrypted
working copy in tmpfs (RAM) per the at-rest encryption landed earlier.
Validated: `docker compose config` clean, mavend.json parses, all daemon flags
confirmed. NOT build-tested (no docker/GPU in authoring env) — deploy/README.md
lists the host-dependent tweak points (GPU passthrough, onnxruntime path,
cross-container voice bind, netdata host).
Chosen Docker over interim systemd units per the "dockerize soon" call — no
throwaway supervisor built.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
kami