Address Qodo review: harden compose (trust-remote-code, env_file, HOME)

- Security: drop --trust-remote-code (Qwen3-32B-NVFP4 loads without it; the flag
  would let model-repo code run in-container alongside HF_TOKEN + the cache mount).
  Documented the swap caveat in README.
- Reliability: env_file -> { path: .env, required: false } so a fresh checkout
  without a .env still runs (only HF_TOKEN needs it).
- Reliability: HF cache mount now ${HF_CACHE:-${HOME:-/root}/.cache/huggingface}
  so it never collapses to /.cache/huggingface when HOME is unset; HF_CACHE
  documented in .env.example.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: OriNachum

.env.example

@@ -20,3 +20,8 @@ VLLM_MAX_MODEL_LEN=32768
 # Fraction of the 128 GB unified memory vLLM may reserve. Lower leaves headroom
 # for the OS and other mesh agents; raise toward 0.85 on a dedicated box.
 VLLM_GPU_MEM_UTIL=0.6
+
+# Host path for the HuggingFace weight cache. Defaults to ~/.cache/huggingface
+# (or /root/.cache/huggingface if $HOME is unset). Set to reuse an existing cache
+# or to pin a specific disk.
+HF_CACHE=

README.md

@@ -52,8 +52,14 @@ curl -fsS http://localhost:8000/health
 curl -s http://localhost:8000/v1/models   # lists nvidia/Qwen3-32B-NVFP4
 ```
 
-Tunables live in `.env` (`VLLM_MODEL`, `VLLM_GPU_MEM_UTIL`, `VLLM_MAX_MODEL_LEN`, …).
-`VLLM_SERVED_NAME` must match the part after `vllm-local/` in `culture.yaml`.
-If vLLM rejects the `nvidia/` ModelOpt checkpoint, set `VLLM_MODEL` to the
-vLLM-native `RedHatAI/Qwen3-32B-NVFP4` and drop `--quantization` from the
-compose `command`.
+Tunables live in `.env` (`VLLM_MODEL`, `VLLM_GPU_MEM_UTIL`, `VLLM_MAX_MODEL_LEN`,
+`HF_CACHE`, …). `VLLM_SERVED_NAME` must match the part after `vllm-local/` in
+`culture.yaml`. The `.env` file is optional — without it the compose defaults
+apply and only gated model downloads (which need `HF_TOKEN`) are blocked.
+
+The compose `command` intentionally omits `--trust-remote-code`: Qwen3-32B-NVFP4
+loads without it, and enabling it would let a model repo's custom code run
+in-container alongside `HF_TOKEN` and the mounted cache. Add it back only for a
+model whose repo ships custom modeling code. If vLLM rejects the `nvidia/`
+ModelOpt checkpoint, set `VLLM_MODEL` to the vLLM-native `RedHatAI/Qwen3-32B-NVFP4`
+and drop `--quantization` from the compose `command`.

docker-compose.yml

@@ -27,13 +27,18 @@ services:
       memlock: { soft: -1, hard: -1 }
       stack: { soft: 67108864, hard: 67108864 }
     env_file:
-      - .env                               # HF_TOKEN lives here (gitignored)
+      # Optional — only HF_TOKEN (for gated repos) really needs it. required:false
+      # keeps `docker compose up` working on a fresh checkout with no .env present.
+      - path: .env
+        required: false
     environment:
       - HF_HOME=/root/.cache/huggingface
       - TOKENIZERS_PARALLELISM=false
     volumes:
-      # Persist downloaded weights across container restarts.
-      - ${HOME}/.cache/huggingface:/root/.cache/huggingface
+      # Persist downloaded weights across restarts. HF_CACHE overrides the host
+      # path; otherwise ~/.cache/huggingface, with /root as the fallback if HOME
+      # is unset (so the mount never collapses to /.cache/huggingface).
+      - ${HF_CACHE:-${HOME:-/root}/.cache/huggingface}:/root/.cache/huggingface
     ports:
       - "${VLLM_PORT:-8000}:8000"
     command:
@@ -49,7 +54,9 @@ services:
       - --gpu-memory-utilization=${VLLM_GPU_MEM_UTIL:-0.6}
       - --reasoning-parser=qwen3           # expose the <think> trace as reasoning_content (drop on older vLLM)
       - --enable-prefix-caching
-      - --trust-remote-code
+      # NOTE: --trust-remote-code is intentionally omitted. Qwen3-32B-NVFP4 loads
+      # without it; add it back only for a model whose repo ships custom modeling
+      # code (it lets that code run in-container alongside HF_TOKEN + the cache mount).
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
       interval: 30s