1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
# Dev Deployment for conproxy LLM (Tilt-managed).
# llama-server runs on host — pod reaches it via hostAliases mapping
# host.docker.internal → Docker gateway IP (filled in by Tiltfile).
#
# Ports match Dockerfile: 9999 gRPC, 10000 HTTP REST.
# No privileged sysctls (dev environment).
apiVersion: apps/v1
kind: Deployment
metadata:
name: conproxy
labels:
app: conproxy
tilt-env: dev
spec:
replicas: 1
selector:
matchLabels:
app: conproxy
template:
metadata:
labels:
app: conproxy
spec:
# Map host.docker.internal to Docker host (llama-server is on host).
# Tiltfile detects HOST_IP from Docker bridge gateway and substitutes
# this placeholder. Works on macOS (native resolve) and Linux kind.
hostAliases:
- ip: "{{HOST_IP}}"
hostnames:
- "host.docker.internal"
containers:
- name: conproxy
image: conproxy
args:
- start
- --listen
- "0.0.0.0:9999"
ports:
- name: grpc
containerPort: 9999
protocol: TCP
- name: http
containerPort: 10000
protocol: TCP
env:
- name: RUST_LOG
value: info
resources:
requests:
memory: "128Mi"
cpu: "100m"
limits:
memory: "512Mi"
cpu: "1000m"
securityContext:
runAsNonRoot: true
runAsUser: 10001
runAsGroup: 10001
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
volumeMounts:
- name: config
mountPath: /var/lib/conproxy/.conproxy
readOnly: true
- name: tmp
mountPath: /tmp
livenessProbe:
httpGet:
path: /health
port: http
initialDelaySeconds: 5
periodSeconds: 10
readinessProbe:
httpGet:
path: /ready
port: http
initialDelaySeconds: 3
periodSeconds: 5
volumes:
- name: config
configMap:
name: conproxy-llm-config
- name: tmp
emptyDir: