Deployment and Operations
Security
Secrets and public HTTP boundaries.
- Store the DashScope key in a secret file. Do not put it in source code, images, logs, or command arguments.
- Replace a key immediately if it appears in chat, terminal records, logs, or a commit.
- Keep Milvus, etcd, MinIO, metrics, and Attu on loopback or a private network.
- Configure exact public Host and Origin values.
- Trust the client-IP header only when the direct peer is in
trusted_proxy_networks. - Treat every
session_idas a private capability.
The container runs the application as UID 10001 with a read-only root filesystem. Root is used only by the entrypoint to copy the secret and set ownership on explicit writable volumes.