Release abstractgateway 0.2.24

Author: lpalbou

.github/workflows/publish-ghcr.yml

@@ -1,4 +1,4 @@
-name: Publish GHCR Server Image
+name: Publish GHCR Gateway Images
 
 on:
   workflow_dispatch:
@@ -18,7 +18,7 @@ concurrency:
 
 jobs:
   publish:
-    name: Publish server image
+    name: Publish Gateway images
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -85,9 +85,11 @@ jobs:
           provenance: false
           push: true
           build-args: |
-            ABSTRACTGATEWAY_INSTALL_MODE=local
+            ABSTRACTGATEWAY_INSTALL_MODE=pypi
             ABSTRACTGATEWAY_VERSION=${{ steps.meta.outputs.version }}
           tags: |
+            ghcr.io/${{ github.repository_owner }}/abstractgateway:${{ steps.meta.outputs.version }}
+            ghcr.io/${{ github.repository_owner }}/abstractgateway:latest
             ghcr.io/${{ github.repository_owner }}/abstractgateway-server:${{ steps.meta.outputs.version }}
             ghcr.io/${{ github.repository_owner }}/abstractgateway-server:latest
       - name: Attempt experimental NVIDIA full server image
@@ -100,9 +102,11 @@ jobs:
           provenance: false
           push: true
           build-args: |
-            ABSTRACTGATEWAY_INSTALL_MODE=local
+            ABSTRACTGATEWAY_INSTALL_MODE=pypi
             ABSTRACTGATEWAY_VERSION=${{ steps.meta.outputs.version }}
             ABSTRACTGATEWAY_EXTRAS=gpu
           tags: |
+            ghcr.io/${{ github.repository_owner }}/abstractgateway:${{ steps.meta.outputs.version }}-gpu
+            ghcr.io/${{ github.repository_owner }}/abstractgateway:gpu-latest
             ghcr.io/${{ github.repository_owner }}/abstractgateway-server-nvidia:${{ steps.meta.outputs.version }}
             ghcr.io/${{ github.repository_owner }}/abstractgateway-server-nvidia:latest

.github/workflows/release.yml

@@ -198,7 +198,7 @@ jobs:
       - uses: pypa/gh-action-pypi-publish@release/v1
 
   publish-ghcr:
-    name: Publish GHCR server image
+    name: Publish GHCR Gateway images
     runs-on: ubuntu-latest
     needs: [build, ensure-tag, publish-pypi]
     permissions:
@@ -244,9 +244,11 @@ jobs:
           provenance: false
           push: true
           build-args: |
-            ABSTRACTGATEWAY_INSTALL_MODE=local
+            ABSTRACTGATEWAY_INSTALL_MODE=pypi
             ABSTRACTGATEWAY_VERSION=${{ needs.build.outputs.version }}
           tags: |
+            ghcr.io/${{ github.repository_owner }}/abstractgateway:${{ needs.build.outputs.version }}
+            ghcr.io/${{ github.repository_owner }}/abstractgateway:latest
             ghcr.io/${{ github.repository_owner }}/abstractgateway-server:${{ needs.build.outputs.version }}
             ghcr.io/${{ github.repository_owner }}/abstractgateway-server:latest
       - name: Attempt experimental NVIDIA full server image
@@ -259,10 +261,12 @@ jobs:
           provenance: false
           push: true
           build-args: |
-            ABSTRACTGATEWAY_INSTALL_MODE=local
+            ABSTRACTGATEWAY_INSTALL_MODE=pypi
             ABSTRACTGATEWAY_VERSION=${{ needs.build.outputs.version }}
             ABSTRACTGATEWAY_EXTRAS=gpu
           tags: |
+            ghcr.io/${{ github.repository_owner }}/abstractgateway:${{ needs.build.outputs.version }}-gpu
+            ghcr.io/${{ github.repository_owner }}/abstractgateway:gpu-latest
             ghcr.io/${{ github.repository_owner }}/abstractgateway-server-nvidia:${{ needs.build.outputs.version }}
             ghcr.io/${{ github.repository_owner }}/abstractgateway-server-nvidia:latest
 

CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.24] - 2026-05-31
+
+### Added
+- Added `abstractgateway-config bootstrap-admin` to create or recover a file-backed `default/admin` Gateway user for hosted/container user-auth deployments.
+- Added a Gateway Docker entrypoint that bootstraps the admin user token into `/data/auth/bootstrap-admin-token` before starting the server.
+- Added first-class GHCR tags for `ghcr.io/lpalbou/abstractgateway:<version>`, `latest`, `<version>-gpu`, and `gpu-latest`, while preserving the legacy `abstractgateway-server` tags during transition.
+
+### Changed
+- Gateway Docker and Compose defaults now use `/data`, enable hosted user auth, and build release images from the just-published PyPI wheel instead of local source.
+- Gateway startup now accepts hosted user-auth deployments without the legacy shared `ABSTRACTGATEWAY_AUTH_TOKEN`.
+
+### Fixed
+- Fixed the PyPI/GHCR release path so container images can start cleanly from the published Gateway wheel and still provide an initial admin login token.
+
 ## [0.2.23] - 2026-05-31
 
 ### Fixed

README.md

@@ -95,17 +95,21 @@ Release images are published to GHCR. The default image is the light,
 portable server image:
 
 ```bash
-docker pull ghcr.io/lpalbou/abstractgateway-server:0.2.23
+docker pull ghcr.io/lpalbou/abstractgateway:0.2.24
 ```
 
 NVIDIA hosts can try the experimental full GPU image when local
 vLLM/HuggingFace/Diffusers engines are wanted. This image is published
 best-effort until it has a real CUDA build and smoke gate:
 
 ```bash
-docker pull ghcr.io/lpalbou/abstractgateway-server-nvidia:0.2.23
+docker pull ghcr.io/lpalbou/abstractgateway:0.2.24-gpu
 ```
 
+Legacy `abstractgateway-server` and `abstractgateway-server-nvidia` GHCR aliases
+are still published for existing deployments; new deployments should use
+`abstractgateway`.
+
 The image installs the base `abstractgateway` package: HTTP server,
 `AbstractRuntime`, Runtime-owned provider/tool and
 multimodal facades, OpenAI-compatible text/media providers,
@@ -121,21 +125,23 @@ AbstractFlow note:
 - You do **not** need the `abstractflow` Python package to run `.flow` bundles (bundle mode). You only need it to author bundles. VisualFlow directory mode was intentionally removed from the gateway to keep the dependency direction clean.
 
 ```bash
-export ABSTRACTGATEWAY_AUTH_TOKEN="$(python -c 'import secrets; print(secrets.token_urlsafe(32))')"
-
-docker run --rm --name abstractgateway-server \
-  -p 127.0.0.1:8080:8080 \
-  -e ABSTRACTGATEWAY_AUTH_TOKEN="$ABSTRACTGATEWAY_AUTH_TOKEN" \
+docker run --rm --name abstractgateway \
+  -p 8080:8080 \
+  -e ABSTRACTGATEWAY_DATA_DIR=/data \
+  -e ABSTRACTGATEWAY_USER_AUTH=1 \
   -e OPENAI_COMPATIBLE_BASE_URL="http://host.docker.internal:1234/v1" \
-  -v "$PWD/runtime/gateway:/data/gateway" \
-  -v "$PWD/flows/bundles:/data/flows:ro" \
-  ghcr.io/lpalbou/abstractgateway-server:0.2.23
+  -v "$PWD/runtime:/data" \
+  ghcr.io/lpalbou/abstractgateway:latest
 ```
 
+On first start, the container creates `default/admin` and writes the admin user
+token to `runtime/auth/bootstrap-admin-token`. Use that token in `/console`,
+then rotate it or create named users from the console.
+
 Configure framework model defaults through execution-host capability routes:
 
 ```bash
-abstractgateway-config set-default output.text \
+docker exec abstractgateway abstractgateway-config set-default output.text \
   --provider openai-compatible \
   --model your-model \
   --base-url http://host.docker.internal:1234/v1

docker/abstractgateway-server/.env.example

@@ -1,6 +1,16 @@
-# Required gateway auth token. Generate with:
-# python -c 'import secrets; print(secrets.token_urlsafe(32))'
-ABSTRACTGATEWAY_AUTH_TOKEN=replace-with-a-gateway-token
+# Gateway user-auth is the default container mode. On first start the
+# entrypoint creates default/admin and writes its token to:
+#   <mounted runtime>/auth/bootstrap-admin-token
+ABSTRACTGATEWAY_USER_AUTH=1
+ABSTRACTGATEWAY_BOOTSTRAP_ADMIN=1
+# Set to 1 for local demos only; production logs should not contain raw tokens.
+ABSTRACTGATEWAY_BOOTSTRAP_PRINT_TOKEN=0
+# Optional fixed bootstrap token. Leave empty to generate one.
+ABSTRACTGATEWAY_BOOTSTRAP_ADMIN_TOKEN=
+
+# Optional legacy shared Gateway admin token for compatibility/bootstrap APIs.
+# Browser apps should sign in with a Gateway user token instead.
+ABSTRACTGATEWAY_AUTH_TOKEN=
 
 # Local bind. Keep loopback unless a reverse proxy/TLS layer handles public access.
 ABSTRACTGATEWAY_PORT=8080
@@ -70,12 +80,13 @@ ABSTRACTVOICE_REMOTE_TIMEOUT_S=
 
 # Local-source builds for unreleased checkouts:
 # ABSTRACTGATEWAY_INSTALL_MODE=local
-# ABSTRACTGATEWAY_VERSION=0.2.4
-# ABSTRACTGATEWAY_IMAGE_TAG=0.2.4-local
-# ABSTRACTGATEWAY_EXTRAS=server,memory
+# ABSTRACTGATEWAY_VERSION=0.2.23
+# ABSTRACTGATEWAY_IMAGE_TAG=0.2.23-local
+# ABSTRACTGATEWAY_EXTRAS=
 
 # NVIDIA full image/local build overlay:
-# ABSTRACTGATEWAY_EXTRAS=server-nvidia
+# ABSTRACTGATEWAY_NVIDIA_IMAGE_TAG=0.2.23-gpu
+# ABSTRACTGATEWAY_EXTRAS=gpu
 # ABSTRACTVISION_BACKEND=diffusers
 # ABSTRACTVISION_DIFFUSERS_DEVICE=cuda
 # ABSTRACTVISION_DIFFUSERS_ALLOW_DOWNLOAD=0

docker/abstractgateway-server/Dockerfile

@@ -10,20 +10,21 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     PIP_NO_CACHE_DIR=1 \
     HOST=0.0.0.0 \
     PORT=8080 \
-    ABSTRACTGATEWAY_DATA_DIR=/data/gateway \
-    ABSTRACTGATEWAY_FLOWS_DIR=/data/flows \
+    ABSTRACTGATEWAY_DATA_DIR=/data \
+    ABSTRACTGATEWAY_USER_AUTH=1 \
     ABSTRACTGATEWAY_WORKFLOW_SOURCE=bundle \
     ABSTRACTGATEWAY_STORE_BACKEND=file \
     ABSTRACTGATEWAY_ALLOWED_ORIGINS=http://localhost:*,http://127.0.0.1:*
 
 RUN addgroup --system abstractgateway \
     && adduser --system --ingroup abstractgateway --home /home/abstractgateway abstractgateway \
-    && mkdir -p /data/gateway /data/flows /workspace \
+    && mkdir -p /data /data/flows /workspace \
     && chown -R abstractgateway:abstractgateway /data /workspace
 
 COPY pyproject.toml README.md CHANGELOG.md /tmp/abstractgateway-src/
 COPY src /tmp/abstractgateway-src/src
 COPY flows/bundles/basic-agent.flow flows/bundles/basic-agent@0.0.1.flow /tmp/abstractgateway-src/flows/bundles/
+COPY docker/abstractgateway-server/entrypoint.sh /usr/local/bin/abstractgateway-docker-entrypoint
 
 RUN apt-get update \
     && apt-get install -y --no-install-recommends build-essential libmagic1 \
@@ -50,14 +51,17 @@ RUN apt-get update \
         fi; \
     fi \
     && apt-get purge -y --auto-remove build-essential \
+    && chmod +x /usr/local/bin/abstractgateway-docker-entrypoint \
     && rm -rf /var/lib/apt/lists/* /tmp/abstractgateway-src
 
 USER abstractgateway
 WORKDIR /home/abstractgateway
 
 EXPOSE 8080
+VOLUME ["/data"]
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=20s --retries=3 \
     CMD python -c "import os, urllib.request; urllib.request.urlopen(f'http://127.0.0.1:{os.getenv(\"PORT\", \"8080\")}/api/health', timeout=3).read()" || exit 1
 
+ENTRYPOINT ["abstractgateway-docker-entrypoint"]
 CMD ["sh", "-c", "abstractgateway serve --host \"${HOST:-0.0.0.0}\" --port \"${PORT:-8080}\""]

docker/abstractgateway-server/Dockerfile.nvidia

@@ -11,8 +11,8 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     PIP_NO_CACHE_DIR=1 \
     HOST=0.0.0.0 \
     PORT=8080 \
-    ABSTRACTGATEWAY_DATA_DIR=/data/gateway \
-    ABSTRACTGATEWAY_FLOWS_DIR=/data/flows \
+    ABSTRACTGATEWAY_DATA_DIR=/data \
+    ABSTRACTGATEWAY_USER_AUTH=1 \
     ABSTRACTGATEWAY_WORKFLOW_SOURCE=bundle \
     ABSTRACTGATEWAY_STORE_BACKEND=file \
     ABSTRACTGATEWAY_ALLOWED_ORIGINS=http://localhost:*,http://127.0.0.1:* \
@@ -28,12 +28,13 @@ RUN apt-get update \
         libsndfile1 \
     && addgroup --system abstractgateway \
     && adduser --system --ingroup abstractgateway --home /home/abstractgateway abstractgateway \
-    && mkdir -p /data/gateway /data/flows /workspace \
+    && mkdir -p /data /data/flows /workspace \
     && chown -R abstractgateway:abstractgateway /data /workspace /home/abstractgateway
 
 COPY pyproject.toml README.md CHANGELOG.md /tmp/abstractgateway-src/
 COPY src /tmp/abstractgateway-src/src
 COPY flows/bundles/basic-agent.flow flows/bundles/basic-agent@0.0.1.flow /tmp/abstractgateway-src/flows/bundles/
+COPY docker/abstractgateway-server/entrypoint.sh /usr/local/bin/abstractgateway-docker-entrypoint
 
 RUN python -m pip install --upgrade pip \
     && if [ "$ABSTRACTGATEWAY_INSTALL_MODE" = "local" ]; then \
@@ -57,14 +58,17 @@ RUN python -m pip install --upgrade pip \
             fi; \
         fi; \
     fi \
+    && chmod +x /usr/local/bin/abstractgateway-docker-entrypoint \
     && rm -rf /tmp/abstractgateway-src
 
 USER abstractgateway
 WORKDIR /home/abstractgateway
 
 EXPOSE 8080
+VOLUME ["/data"]
 
 HEALTHCHECK --interval=30s --timeout=5s --start-period=40s --retries=3 \
     CMD python -c "import os, urllib.request; urllib.request.urlopen(f'http://127.0.0.1:{os.getenv(\"PORT\", \"8080\")}/api/health', timeout=3).read()" || exit 1
 
+ENTRYPOINT ["abstractgateway-docker-entrypoint"]
 CMD ["sh", "-c", "abstractgateway serve --host \"${HOST:-0.0.0.0}\" --port \"${PORT:-8080}\""]

docker/abstractgateway-server/README.md

@@ -4,17 +4,21 @@ This image packages the AbstractGateway HTTP/SSE server for durable
 AbstractRuntime runs:
 
 ```bash
-ghcr.io/lpalbou/abstractgateway-server:0.2.15
+ghcr.io/lpalbou/abstractgateway:0.2.24
 ```
 
 Release images are published for `linux/amd64` and `linux/arm64`.
 A separate experimental full NVIDIA image is published best-effort for
 `linux/amd64`:
 
 ```bash
-ghcr.io/lpalbou/abstractgateway-server-nvidia:0.2.15
+ghcr.io/lpalbou/abstractgateway:0.2.24-gpu
 ```
 
+Legacy aliases `ghcr.io/lpalbou/abstractgateway-server:*` and
+`ghcr.io/lpalbou/abstractgateway-server-nvidia:*` are still published for a
+transition period. New deployments should use `abstractgateway`.
+
 The image installs:
 
 ```bash
@@ -50,7 +54,12 @@ that route through its native MLX runner.
 Keep secrets in an uncommitted env file:
 
 ```bash
-ABSTRACTGATEWAY_AUTH_TOKEN=replace-with-a-gateway-token
+ABSTRACTGATEWAY_USER_AUTH=1
+ABSTRACTGATEWAY_BOOTSTRAP_ADMIN=1
+ABSTRACTGATEWAY_BOOTSTRAP_PRINT_TOKEN=0
+ABSTRACTGATEWAY_BOOTSTRAP_ADMIN_TOKEN=
+# Optional legacy shared admin token; browser apps should use Gateway user tokens.
+ABSTRACTGATEWAY_AUTH_TOKEN=
 ABSTRACTGATEWAY_PROVIDER=openai-compatible
 ABSTRACTGATEWAY_MODEL=your-model
 OPENAI_API_KEY=sk-...
@@ -72,32 +81,35 @@ ABSTRACTVOICE_REMOTE_API_KEY=
 Then run:
 
 ```bash
-docker run --rm --name abstractgateway-server \
-  -p 127.0.0.1:8080:8080 \
+docker run --rm --name abstractgateway \
+  -p 8080:8080 \
   --env-file .env \
-  -v "$PWD/runtime/gateway:/data/gateway" \
-  -v "$PWD/flows/bundles:/data/flows:ro" \
+  -v "$PWD/runtime:/data" \
   -v "$PWD/workspace:/workspace" \
-  ghcr.io/lpalbou/abstractgateway-server:0.2.15
+  ghcr.io/lpalbou/abstractgateway:latest
 ```
 
-`ABSTRACTGATEWAY_AUTH_TOKEN` is the gateway bearer token. Clients send it as
-`Authorization: Bearer <token>`, including from Swagger UI's `Authorize`
-button. Provider keys stay inside the container.
+The container uses Gateway user auth by default. On first start the entrypoint
+creates the `default/admin` user and writes the raw token once to
+`runtime/auth/bootstrap-admin-token` inside the mounted data directory. Use that
+token in `/console` and then create/rotate/manage users from the Gateway
+Console. Set `ABSTRACTGATEWAY_BOOTSTRAP_PRINT_TOKEN=1` only for local demos
+where Docker logs are private. Provider keys stay inside the container.
 
 For local OpenAI-compatible text endpoints such as Docker Model Runner, LM
 Studio, `mlx_lm.server`, or Ollama's `/v1` server, point the container at a URL
 reachable from Docker:
 
 ```bash
-docker run --rm --name abstractgateway-server \
-  -p 127.0.0.1:8080:8080 \
-  -e ABSTRACTGATEWAY_AUTH_TOKEN="$ABSTRACTGATEWAY_AUTH_TOKEN" \
+docker run --rm --name abstractgateway \
+  -p 8080:8080 \
+  -e ABSTRACTGATEWAY_USER_AUTH=1 \
   -e ABSTRACTGATEWAY_PROVIDER="openai-compatible" \
   -e ABSTRACTGATEWAY_MODEL="your-model" \
   -e OPENAI_COMPATIBLE_BASE_URL="http://host.docker.internal:1234/v1" \
   -e OPENAI_COMPATIBLE_API_KEY="$OPENAI_COMPATIBLE_API_KEY" \
-  ghcr.io/lpalbou/abstractgateway-server:0.2.15
+  -v "$PWD/runtime:/data" \
+  ghcr.io/lpalbou/abstractgateway:latest
 ```
 
 Use `http://model-runner.docker.internal/engines/v1` for Docker Model Runner,
@@ -134,6 +146,8 @@ Useful compose variables:
 - `embedding.text` capability default: configure through `abstractgateway-config set-default embedding.text ...`; remote/provider-backed embeddings work in the default image, local HuggingFace/sentence-transformer embeddings require an image built with `abstractgateway[embeddings]`
 - `ABSTRACTVISION_*`: AbstractVision image backend or OpenAI-compatible image endpoint
 - `ABSTRACTVOICE_*`: AbstractVoice TTS/STT backend, local/remote engine, and model controls
+- `ABSTRACTGATEWAY_USER_AUTH`: `1` for per-user Gateway tokens and browser sessions
+- `ABSTRACTGATEWAY_BOOTSTRAP_ADMIN`: `1` to ensure `default/admin` exists at container start
 - `ABSTRACTGATEWAY_EXTRAS`: build-time install extra for local image builds (empty for the default image, `gpu` for NVIDIA)
 
 Release scope: TTS, STT, and generated images are direct Gateway endpoints.
@@ -144,7 +158,7 @@ For unreleased local checkouts, build the image from this repository:
 
 ```bash
 ABSTRACTGATEWAY_INSTALL_MODE=local \
-ABSTRACTGATEWAY_IMAGE_TAG=0.2.15-local \
+ABSTRACTGATEWAY_IMAGE_TAG=0.2.24-local \
 docker compose -f docker/abstractgateway-server/compose.yml up -d --build
 ```
 
@@ -153,6 +167,7 @@ docker compose -f docker/abstractgateway-server/compose.yml up -d --build
 ```bash
 curl http://localhost:8080/api/health
 
-curl -H "Authorization: Bearer $ABSTRACTGATEWAY_AUTH_TOKEN" \
-  http://localhost:8080/api/gateway/bundles
+ADMIN_TOKEN="$(docker exec abstractgateway cat /data/auth/bootstrap-admin-token)"
+curl -H "Authorization: Bearer $ADMIN_TOKEN" \
+  http://localhost:8080/api/gateway/me
 ```