86f7f1fa76
Codebase audit identified 23 findings across 4 dimensions (production safety, code health, deployment readiness, test quality). This commit fixes all of them. Broker execution layer (was entirely stubbed): - Real IBKR TWS client via ibapi crate (950+ lines, feature-gated) - ICMarkets ctrader-openapi now always-on (removed feature flag) - Real broker routing with health monitoring and exponential backoff reconnect - Validated against live IB Gateway Docker (6/6 connectivity tests pass) Deployment blockers: - Fixed 6 broken Dockerfiles (removed COPY foxhunt-deploy) - Created foxhunt K8s namespace, secret templates, migration job - Added liveness probes to all 7 K8s services - IB Gateway manifest (ghcr.io/gnzsnz/ib-gateway:stable) - IBKR credentials in Scaleway Secret Manager via Terragrunt - Fixed port collisions and mismatches across services Production safety (9 critical + 6 high/medium fixes): - Asset-class-specific VaR volatility (not flat 2%) - Real parametric VaR with z-score 95th percentile - Kyle's lambda regression (100-bar rolling window) - Per-feature running statistics from historical data - VWAP-based slippage reference, regime duration tracking - Real Databento JSON parsing for OHLCV/Trade/Quote Code health: - Removed #![allow(dead_code)] from ml, data, config - Fixed log:: → tracing:: in 4 production files - Removed dead workspace deps (ratatui, crossterm) Verified: cargo check --workspace (0 errors), trading_engine 330 tests pass. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
166 lines
6.0 KiB
Docker
166 lines
6.0 KiB
Docker
# Foxhunt Broker Gateway Service - Production Build
|
|
# Multi-stage build with cargo-chef for dependency caching
|
|
# GLIBC 2.35 (Ubuntu 22.04), no CUDA required (CPU-only service)
|
|
# Optimized for BuildKit layer caching
|
|
|
|
# ============================================================================
|
|
# Stage 1: Builder Dependencies - Build dependencies in cached layer
|
|
# ============================================================================
|
|
FROM rust:1.89-slim AS builder-deps
|
|
|
|
# Install system dependencies (protobuf, SSL, build tools)
|
|
RUN apt-get update && apt-get install -y \
|
|
curl \
|
|
git \
|
|
build-essential \
|
|
pkg-config \
|
|
libssl-dev \
|
|
ca-certificates \
|
|
protobuf-compiler \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
WORKDIR /app
|
|
|
|
# Copy workspace manifests first for dependency caching
|
|
COPY Cargo.toml Cargo.lock ./
|
|
|
|
# Copy sqlx offline cache for compile-time query verification
|
|
COPY .sqlx ./.sqlx
|
|
|
|
# Copy all workspace members (needed for workspace resolution)
|
|
COPY trading_engine ./trading_engine
|
|
COPY risk ./risk
|
|
COPY risk-data ./risk-data
|
|
COPY trading-data ./trading-data
|
|
COPY fxt ./fxt
|
|
COPY ml ./ml
|
|
COPY ml-data ./ml-data
|
|
COPY data ./data
|
|
COPY backtesting ./backtesting
|
|
COPY adaptive-strategy ./adaptive-strategy
|
|
COPY common ./common
|
|
COPY storage ./storage
|
|
COPY model_loader ./model_loader
|
|
COPY market-data ./market-data
|
|
COPY database ./database
|
|
COPY config ./config
|
|
COPY web-gateway ./web-gateway
|
|
COPY ctrader-openapi ./ctrader-openapi
|
|
COPY services/backtesting_service ./services/backtesting_service
|
|
COPY services/broker_gateway_service ./services/broker_gateway_service
|
|
COPY services/trading_service ./services/trading_service
|
|
COPY services/ml_training_service ./services/ml_training_service
|
|
COPY services/data_acquisition_service ./services/data_acquisition_service
|
|
COPY services/trading_agent_service ./services/trading_agent_service
|
|
COPY services/api_gateway ./services/api_gateway
|
|
COPY services/load_tests ./services/load_tests
|
|
COPY services/stress_tests ./services/stress_tests
|
|
COPY services/integration_tests ./services/integration_tests
|
|
COPY tests ./tests
|
|
|
|
# Enable sqlx offline mode to use cached query metadata
|
|
ENV SQLX_OFFLINE=true
|
|
|
|
# Build dependencies (this layer is cached unless dependencies change)
|
|
# Use BuildKit cache mount for cargo registry
|
|
RUN --mount=type=cache,target=/usr/local/cargo/registry \
|
|
--mount=type=cache,target=/usr/local/cargo/git \
|
|
cargo build -p broker_gateway_service --release --lib
|
|
|
|
# ============================================================================
|
|
# Stage 2: Builder Application - Build broker_gateway_service binary
|
|
# ============================================================================
|
|
FROM builder-deps AS builder
|
|
|
|
# Copy entire workspace
|
|
COPY . .
|
|
|
|
# Set SQLX offline mode (no database connection during build)
|
|
ENV SQLX_OFFLINE=true
|
|
|
|
# Build broker_gateway_service binary
|
|
# Use BuildKit cache mount for cargo registry and target directory
|
|
RUN --mount=type=cache,target=/usr/local/cargo/registry \
|
|
--mount=type=cache,target=/usr/local/cargo/git \
|
|
--mount=type=cache,target=/app/target \
|
|
cargo build -p broker_gateway_service --release && \
|
|
# Copy binary out of cached target directory to persistent location
|
|
mkdir -p /app/binaries && \
|
|
cp /app/target/release/broker_gateway_service /app/binaries/
|
|
|
|
# Verify binary exists and strip debug symbols to reduce size
|
|
RUN ls -lh /app/binaries/broker_gateway_service && \
|
|
strip /app/binaries/broker_gateway_service && \
|
|
ls -lh /app/binaries/broker_gateway_service
|
|
|
|
# ============================================================================
|
|
# Stage 3: Runtime - Minimal production image (Ubuntu 22.04)
|
|
# ============================================================================
|
|
FROM ubuntu:22.04 AS runtime
|
|
|
|
# Install minimal runtime dependencies
|
|
RUN apt-get update && apt-get install -y \
|
|
ca-certificates \
|
|
libssl3 \
|
|
curl \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Download and install grpc_health_probe for Kubernetes health checks
|
|
RUN curl -sSL https://github.com/grpc-ecosystem/grpc-health-probe/releases/download/v0.4.25/grpc_health_probe-linux-amd64 \
|
|
-o /usr/local/bin/grpc_health_probe && \
|
|
chmod +x /usr/local/bin/grpc_health_probe
|
|
|
|
# Create non-root user for security (uid 1000 matches development environment)
|
|
RUN groupadd --system --gid 1000 foxhunt && \
|
|
useradd --system --uid 1000 --gid foxhunt --shell /bin/bash foxhunt
|
|
|
|
# Create application directories with proper permissions
|
|
RUN mkdir -p /app/config /app/logs /app/data && \
|
|
chown -R foxhunt:foxhunt /app
|
|
|
|
# Set working directory
|
|
WORKDIR /app
|
|
|
|
# Copy broker_gateway_service binary from builder stage
|
|
COPY --from=builder /app/binaries/broker_gateway_service /usr/local/bin/broker_gateway_service
|
|
|
|
# Set executable permissions
|
|
RUN chmod +x /usr/local/bin/broker_gateway_service
|
|
|
|
# Verify GLIBC version (Ubuntu 22.04 = GLIBC 2.35)
|
|
RUN ldd --version
|
|
|
|
# Change ownership to non-root user
|
|
RUN chown foxhunt:foxhunt /usr/local/bin/broker_gateway_service
|
|
|
|
# Switch to non-root user
|
|
USER foxhunt
|
|
|
|
# Expose ports
|
|
# 50056: gRPC service port
|
|
# 8086: Health check HTTP endpoint
|
|
# 9096: Prometheus metrics endpoint
|
|
EXPOSE 50056 8086 9096
|
|
|
|
# Health check using grpc_health_probe (Kubernetes will use this)
|
|
HEALTHCHECK --interval=10s --timeout=5s --start-period=30s --retries=3 \
|
|
CMD /usr/local/bin/grpc_health_probe -addr=localhost:50056 || exit 1
|
|
|
|
# Metadata labels
|
|
ARG GIT_COMMIT=unknown
|
|
ARG BUILD_DATE=unknown
|
|
ARG VERSION=0.1.0
|
|
|
|
LABEL org.opencontainers.image.title="Foxhunt Broker Gateway Service" \
|
|
org.opencontainers.image.description="FIX order routing to AMP Futures (CQG)" \
|
|
org.opencontainers.image.version="${VERSION}" \
|
|
org.opencontainers.image.created="${BUILD_DATE}" \
|
|
org.opencontainers.image.vendor="Foxhunt HFT Trading System" \
|
|
org.opencontainers.image.revision="${GIT_COMMIT}" \
|
|
foxhunt.service.name="broker_gateway_service" \
|
|
foxhunt.service.port="50056" \
|
|
foxhunt.glibc.version="2.35"
|
|
|
|
# Default command: Run broker_gateway_service
|
|
CMD ["/usr/local/bin/broker_gateway_service"]
|