rtpipeline/docker-compose.yml at main · kstawiski/rtpipeline · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
version: '3.8'

services:
  # Main rtpipeline service with GPU support (DEFAULT)
  rtpipeline:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        BUILD_DATE: ${BUILD_DATE:-$(date -u +'%Y-%m-%dT%H:%M:%SZ')}
    image: kstawiski/rtpipeline:latest
    container_name: rtpipeline
    hostname: rtpipeline
    # Run as non-root user (UID 1000) to match host permissions
    user: "1000:1000"
    volumes:
      - ./Input:/data/input:rw
      - ./Output:/data/output:rw
      - ./Logs:/data/logs:rw

      # TotalSegmentator weights are bundled in the image - no need to mount
      # Uncomment below ONLY if you need to use newer weights than in the image:
      # - ./totalseg_weights:/home/rtpipeline/.totalsegmentator:rw

      - ./Uploads:/data/uploads:rw
      # Code mounted read-only for security
      - ./Code:/app/Code:ro
      - ./rtpipeline:/app/rtpipeline:ro
    ports:
      - "8080:8080"
    environment:
      - PYTHONPATH=/app
      - NUMBA_CACHE_DIR=/tmp/cache
      - MPLCONFIGDIR=/tmp/cache
      - CONDA_DIR=/opt/conda
      - PATH=/opt/conda/bin:$PATH
      # nnUNet environment paths (required for TotalSegmentator)
      - nnUNet_results=/home/rtpipeline/.totalsegmentator/nnunet/results
      - nnUNet_raw=/home/rtpipeline/.totalsegmentator/nnunet/raw
      - nnUNet_preprocessed=/home/rtpipeline/.totalsegmentator/nnunet/preprocessed
      # Timeouts for preventing hangs
      - TOTALSEG_TIMEOUT=3600
      - DCM2NIIX_TIMEOUT=300
      - RTPIPELINE_RADIOMICS_TASK_TIMEOUT=600
      # TotalSegmentator parallelism (avoid spawning issues in container)
      - TOTALSEG_NUM_PROCESSES_PREPROCESSING=1
      - TOTALSEG_NUM_PROCESSES_SEGMENTATION_EXPORT=1
      - TOTALSEG_FORCE_TORCH_NUM_THREADS=1
      - TOTALSEG_PRELOAD_WEIGHTS=1
      # PyTorch threading and memory control - use num_cores - 1 for optimal GPU parallelism
      - OMP_NUM_THREADS=8
      - MKL_NUM_THREADS=8
      - PYTORCH_CUDA_ALLOC_CONF=expandable_segments:True
      - PORT=8080
      - DEBUG=false
    working_dir: /app
    command: >
      bash -c "
        cd /app/webui &&
        python app.py
      "
    # Security hardening
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - SETGID
      - SETUID
      - SYS_PTRACE
    # Resource limits - maximize CPU usage (num_cores - 1 = 23)
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu]
        limits:
          cpus: '23.0'
          memory: 48G
    # Increased shm_size for TotalSegmentator/PyTorch (prevents container hangs)
    shm_size: '8gb'
    restart: unless-stopped

  # CPU-only service
  rtpipeline-cpu:
    build:
      context: .
      dockerfile: Dockerfile
      args:
        BUILD_DATE: ${BUILD_DATE:-$(date -u +'%Y-%m-%dT%H:%M:%SZ')}
    image: kstawiski/rtpipeline:latest
    container_name: rtpipeline-cpu
    hostname: rtpipeline-cpu
    user: "1000:1000"
    volumes:
      - ./Input:/data/input:rw
      - ./Output:/data/output:rw
      - ./Logs:/data/logs:rw

      # TotalSegmentator weights are bundled in the image - no need to mount
      # Uncomment below ONLY if you need to use newer weights than in the image:
      # - ./totalseg_weights:/home/rtpipeline/.totalsegmentator:rw

      - ./Uploads:/data/uploads:rw
      - ./Code:/app/Code:ro
      - ./rtpipeline:/app/rtpipeline:ro
    ports:
      - "8080:8080"
    environment:
      - PYTHONPATH=/app
      - NUMBA_CACHE_DIR=/tmp/cache
      - MPLCONFIGDIR=/tmp/cache
      - CONDA_DIR=/opt/conda
      - PATH=/opt/conda/bin:$PATH
      # nnUNet environment paths (required for TotalSegmentator)
      - nnUNet_results=/home/rtpipeline/.totalsegmentator/nnunet/results
      - nnUNet_raw=/home/rtpipeline/.totalsegmentator/nnunet/raw
      - nnUNet_preprocessed=/home/rtpipeline/.totalsegmentator/nnunet/preprocessed
      # Timeouts for preventing hangs (longer for CPU mode)
      - TOTALSEG_TIMEOUT=7200
      - DCM2NIIX_TIMEOUT=300
      - RTPIPELINE_RADIOMICS_TASK_TIMEOUT=1200
      # TotalSegmentator parallelism (avoid spawning issues in container)
      - TOTALSEG_NUM_PROCESSES_PREPROCESSING=1
      - TOTALSEG_NUM_PROCESSES_SEGMENTATION_EXPORT=1
      - TOTALSEG_FORCE_TORCH_NUM_THREADS=1
      - TOTALSEG_PRELOAD_WEIGHTS=1
      # PyTorch threading control - use num_cores - 1 for optimal CPU mode parallelism
      - OMP_NUM_THREADS=23
      - MKL_NUM_THREADS=23
      - PORT=8080
      - DEBUG=false
    working_dir: /app
    command: >
      bash -c "
        cd /app/webui &&
        python app.py
      "
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - SYS_PTRACE
    deploy:
      resources:
        limits:
          cpus: '23.0'
          memory: 48G
        reservations:
          cpus: '4.0'
          memory: 8G
    # Increased shm_size for TotalSegmentator/PyTorch (prevents container hangs)
    shm_size: '8gb'
    restart: unless-stopped
    profiles:
      - cpu-only

networks:
  default:
    name: rtpipeline-network