LucaSforza · Sep 10, 2026 · Sep 8, 2026 · Sep 8, 2026 · Sep 8, 2026 · Sep 8, 2026
diff --git a/.agents/skills/nnmodelling-backend-admin/SKILL.md b/.agents/skills/nnmodelling-backend-admin/SKILL.md
@@ -37,6 +37,10 @@ reconfiguring anything.
   Treat that socket as host-administrator authority.
 - Worker images must be immutable digest references. Never silently use a
   mutable tag or a host-Python fallback.
+- When code or dependencies executed by the worker change, run
+  `just --justfile converted/backend/justfile worker-build`, then restart
+  FastAPI with the printed `NNM_CONTAINER_IMAGE` digest. Restarting a backend
+  alone deliberately preserves its previously configured worker image.
 - Disabled and offline W&B jobs use `--network none` and receive no credential.
   Online jobs require an operator-managed egress network, allowlisting proxy,
   and owner-only credential file delivered to the worker over stdin.
@@ -69,6 +73,51 @@ reconfiguring anything.
    sanitized configuration, and leave unrelated services and user changes
    untouched.
 
+## Persistent Podman Compose deployment
+
+`converted/backend/docker-compose.yml` is the supported single-file
+instantiation for the persistent local backend. On this machine use Podman:
+`podman compose`, not `docker compose`. The file starts Valkey, the FastAPI
+service, and the trusted container controller; it does not create the
+operator-managed W&B egress network or proxy. Those must already exist when
+online W&B jobs are enabled.
+
+The standard path is:
+
+```text
+just --justfile converted/backend/justfile compose
+```
+
+That recipe builds the worker first, obtains its immutable image digest, starts
+the rootless Podman socket, and passes the host paths required by the backend
+and controller. It uses the unsafe-unlimited dataset-size mode and localhost
+Origins from the Compose defaults. Do not put tokens or W&B keys in the
+command line or Compose file.
+
+For a non-standard user requirement, the backend administrator should execute
+`podman compose` directly instead of using `just compose`, explicitly setting
+the needed `NNM_*` variables. At minimum, validate the expanded file before
+starting it:
+
+```text
+podman compose --project-name nnm-backend \
+  -f converted/backend/docker-compose.yml config
+podman compose --project-name nnm-backend \
+  -f converted/backend/docker-compose.yml up --build -d
+```
+
+The required host-path variables are `NNM_HOST_VALKEY_DATA`, `NNM_HOST_JOBS`,
+`NNM_HOST_DATA`, `NNM_HOST_ADMIN_TOKEN`, and
+`NNM_HOST_CONTROLLER_TOKEN`; `NNM_CONTAINER_IMAGE` must be a digest-pinned
+worker reference. Use `NNM_WANDB_CREDENTIAL_FILE`, `NNM_WANDB_NETWORK`, and
+`NNM_WANDB_PROXY_URL` only for the already-configured W&B integration. The
+controller is the only Compose service that receives the Podman socket; the
+backend talks to it through the authenticated controller socket.
+
+Inspect without changing state with `podman compose ... ps` and stop the
+deployment with `podman compose ... down`. Do not add `--volumes`: the Valkey
+data and job directories are host-mounted persistent state.
+
 ## Authorization and stopping rules
 
 Read-only health, status, capability, job, session, process, socket, image, and

diff --git a/.agents/skills/nnmodelling-backend-admin/references/operations.md b/.agents/skills/nnmodelling-backend-admin/references/operations.md
@@ -26,6 +26,21 @@ Before startup, run:
 just --justfile converted/backend/justfile container-config
 ```
 
+## Worker-image lifecycle
+
+The package worker runs immutable code from `NNM_CONTAINER_IMAGE`; a FastAPI
+restart does not rebuild or replace that image. Whenever a change affects
+`package_worker.py`, training/runtime code, worker dependencies, the lockfile,
+or the worker Dockerfile, build a fresh local image first:
+
+```bash
+just --justfile converted/backend/justfile worker-build
+```
+
+The recipe prints an `NNM_CONTAINER_IMAGE=localhost/nnm-worker@sha256:...`
+line. Use that exact digest to start or restart FastAPI. The local tag is only a
+build label and must never be passed to the backend in place of the digest.
+
 Inspect an occupied port and its owning PID before stopping anything. A healthy
 listener owned by the current workflow should be reused.
 

diff --git a/.gitignore b/.gitignore
@@ -1,5 +1,4 @@
 *.bak_*
-.agents/
 .claude/
 .qwen/
 skills-lock.json

diff --git a/analysis/uml/.nn.vpp.lck b/analysis/uml/.nn.vpp.lck
diff --git a/analysis/uml/nn.vpp b/analysis/uml/nn.vpp
diff --git a/analysis/uml/nn.vpp.bak2 b/analysis/uml/nn.vpp.bak2
diff --git a/converted/.gitignore b/converted/.gitignore
@@ -1,6 +1,7 @@
 outputs
 jobs/
 valkey-data/
+backend-secrets/
 dump.rdb
 *.pyc
 multirun

diff --git a/converted/README.md b/converted/README.md
@@ -46,6 +46,26 @@ a typed `network.format="package"` training request. Jobs are executed by the
 configured Podman or Docker container controller and expose status, logs,
 events, cancellation and the portable model wheel through the API.
 
+## Package worker image
+
+The worker is an immutable container image. Rebuild it whenever a change affects
+code or dependencies executed in the worker, then restart FastAPI with the
+printed digest. Restarting FastAPI alone keeps using its previous worker image.
+
+```bash
+just --justfile converted/backend/justfile worker-build
+# Copy the printed NNM_CONTAINER_IMAGE=...@sha256:... value into the backend launch.
+```
+
+Pass an optional local tag when keeping multiple development images:
+
+```bash
+just --justfile converted/backend/justfile worker-build classification-metrics
+```
+
+The tag is only a local build label. Always configure FastAPI with the printed
+digest reference, never the tag.
+
 ## Weights & Biases administration
 
 W&B uses one backend-administrator-owned account. Connect it from the repository
@@ -61,7 +81,7 @@ just --justfile converted/backend/justfile wandb-disconnect
 ```
 
 `wandb-connect` verifies the account before atomically writing
-`converted/valkey-data/wandb-credentials.json` with mode `0600`.
+`converted/backend-secrets/wandb-credentials.json` with mode `0600`.
 `wandb-status` prints only the schema version, entity and base URL. Override the
 machine-local path with `NNM_WANDB_CREDENTIAL_FILE` when required.
 

diff --git a/converted/backend/Dockerfile b/converted/backend/Dockerfile
@@ -2,21 +2,22 @@ FROM python:3.12-slim
 
 WORKDIR /app
 
-COPY pyproject.toml uv.lock ./
 RUN apt-get update \
     && apt-get install -y --no-install-recommends podman ca-certificates \
     && rm -rf /var/lib/apt/lists/* \
     && pip install --no-cache-dir uv
 
+COPY pyproject.toml uv.lock ./
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --locked --no-dev --no-install-project
+
 COPY src ./src
-COPY README.md ./README.md
 
 ENV PYTHONPATH=/app/src
 ENV NNM_CONVERTED_DIR=/app
 ENV NNM_BACKEND_ARTIFACT_ROOT=/app/jobs
 ENV NNM_CONTAINER_ENGINE=podman
-
-RUN uv sync --no-dev
+ENV UV_NO_SYNC=1
 
 EXPOSE 8000
 CMD ["uv", "run", "python", "-m", "backend.cli", "--host", "0.0.0.0", "--port", "8000"]
diff --git a/converted/backend/README.md b/converted/backend/README.md
@@ -26,7 +26,7 @@ NNM_ALLOWED_ORIGINS=http://192.168.1.30:5174 \
 just --justfile converted/backend/justfile backend
 ```
 
-`backend` creates an untracked `valkey-data/admin.token` with mode `0600` when
+`backend` creates an untracked `backend-secrets/admin.token` with mode `0600` when
 needed. Approve the code displayed by the frontend:
 
 ```bash

diff --git a/converted/backend/docker-compose.yml b/converted/backend/docker-compose.yml
@@ -1,71 +1,129 @@
 services:
   valkey:
-    image: valkey/valkey:8
-    command: ["valkey-server", "/usr/local/etc/valkey/valkey.conf", "--dir", "/data", "--bind", "0.0.0.0", "--protected-mode", "no"]
+    image: ${NNM_VALKEY_IMAGE:-docker.io/valkey/valkey:8}
+    command:
+      - valkey-server
+      - /usr/local/etc/valkey/valkey.conf
+      - --dir
+      - /data
+      - --bind
+      - 0.0.0.0
+      - --protected-mode
+      - "no"
     volumes:
-      - valkey-data:/data
+      # Preserve pairing, queue and job metadata from the host deployment.
+      - ${NNM_HOST_VALKEY_DATA:?set NNM_HOST_VALKEY_DATA to the Valkey data directory}:/data
       - ./valkey.conf:/usr/local/etc/valkey/valkey.conf:ro
     healthcheck:
       test: ["CMD", "valkey-cli", "ping"]
       interval: 5s
       timeout: 3s
       retries: 10
+    restart: unless-stopped
 
   backend:
+    image: ${NNM_BACKEND_IMAGE:-localhost/nnm-backend:4c1083b}
     build:
       context: ..
       dockerfile: backend/Dockerfile
+    command:
+      - uv
+      - run
+      - python
+      - -m
+      - backend.cli
+      - --host
+      - 0.0.0.0
+      - --port
+      - "8000"
+      - --unsafe-unlimited-dataset-size
+    user: "${NNM_CONTAINER_UID:-1000}:${NNM_CONTAINER_GID:-1000}"
+    # Preserve the invoking rootless user's numeric identity for owner-only
+    # host secrets and the shared controller socket volume.
+    userns_mode: "${NNM_CONTAINER_USERNS_MODE:-keep-id}"
     environment:
+      UV_CACHE_DIR: /tmp/uv-cache
       NNM_VALKEY_URL: valkey://valkey:6379/0
-      NNM_BACKEND_ARTIFACT_ROOT: /app/jobs
+      NNM_BACKEND_ARTIFACT_ROOT: ${NNM_HOST_JOBS:?set NNM_HOST_JOBS to the absolute host jobs directory}
+      NNM_BACKEND_PACKAGE_ROOT: ${NNM_HOST_JOBS:?set NNM_HOST_JOBS to the absolute host jobs directory}/packages
+      NNM_BACKEND_DATASET_ROOT: ${NNM_HOST_JOBS:?set NNM_HOST_JOBS to the absolute host jobs directory}/datasets
       NNM_ADMIN_TOKEN_FILE: /run/secrets/nnm-admin-token
-      NNM_ALLOWED_ORIGINS: ${NNM_ALLOWED_ORIGINS:-http://127.0.0.1:5174}
+      NNM_ALLOWED_ORIGINS: ${NNM_ALLOWED_ORIGINS:-http://127.0.0.1:5174,http://localhost:5174,http://127.0.0.1:5173,http://localhost:5173}
       NNM_SESSION_TTL: ${NNM_SESSION_TTL:-24h}
-      NNM_CONTAINER_ENGINE: ${NNM_CONTAINER_ENGINE:-podman}
+      NNM_CONTAINER_ENGINE: "${NNM_CONTAINER_ENGINE:-podman}"
       NNM_CONTAINER_IMAGE: ${NNM_CONTAINER_IMAGE:?set NNM_CONTAINER_IMAGE to a digest-pinned worker image}
-      NNM_CONTAINER_DATA_ROOT: /app/data
+      NNM_CONTAINER_DATA_ROOT: ${NNM_HOST_DATA:?set NNM_HOST_DATA to the absolute host data directory}
       NNM_CONTAINER_CONTROLLER_SOCKET: /run/nnm/controller.sock
       NNM_CONTAINER_CONTROLLER_TOKEN_FILE: /run/secrets/nnm-controller-token
     ports:
-      - "8000:8000"
+      - "127.0.0.1:8000:8000"
     volumes:
-      - backend-jobs:/app/jobs
-      - ../valkey-data/admin.token:/run/secrets/nnm-admin-token:ro
+      # These paths must match the host paths seen by Podman workers.
+      - ${NNM_HOST_JOBS:?set NNM_HOST_JOBS to the absolute host jobs directory}:${NNM_HOST_JOBS}:rw
       - controller-socket:/run/nnm:ro
-      - ${NNM_CONTAINER_CONTROLLER_TOKEN_FILE:-../valkey-data/controller.token}:/run/secrets/nnm-controller-token:ro
+      - ${NNM_HOST_ADMIN_TOKEN:?set NNM_HOST_ADMIN_TOKEN to the admin token path}:/run/secrets/nnm-admin-token:ro
+      - ${NNM_HOST_CONTROLLER_TOKEN:?set NNM_HOST_CONTROLLER_TOKEN to the controller token path}:/run/secrets/nnm-controller-token:ro
     depends_on:
       valkey:
         condition: service_healthy
+      controller:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/health')"]
+      interval: 5s
+      timeout: 3s
+      retries: 12
+    restart: unless-stopped
 
-  # The only service with access to the host container-engine socket. FastAPI
-  # can reach this service only through the owner-only authenticated Unix
-  # socket above; it has no engine CLI capability or socket mount.
+  # The only service allowed to access the host Podman socket. FastAPI reaches
+  # it through the owner-only authenticated Unix socket above.
   controller:
+    image: ${NNM_BACKEND_IMAGE:-localhost/nnm-backend:4c1083b}
     build:
       context: ..
       dockerfile: backend/Dockerfile
+    user: "${NNM_CONTAINER_UID:-1000}:${NNM_CONTAINER_GID:-1000}"
+    # The rootless Podman socket is owned by the invoking host user. Without
+    # keep-id, UID 1000 in the container is remapped to a subordinate host UID.
+    userns_mode: "${NNM_CONTAINER_USERNS_MODE:-keep-id}"
+    security_opt:
+      - label=disable
     environment:
-      NNM_CONTAINER_ENGINE: ${NNM_CONTAINER_ENGINE:-podman}
-      NNM_CONTAINER_DATA_ROOT: ${NNM_CONTAINER_DATA_ROOT:-/app/data}
+      HOME: /tmp
+      UV_CACHE_DIR: /tmp/uv-cache
+      NNM_CONTAINER_ENGINE: "${NNM_CONTAINER_ENGINE:-podman}"
+      NNM_CONTAINER_DATA_ROOT: ${NNM_HOST_DATA:?set NNM_HOST_DATA to the absolute host data directory}
       NNM_WANDB_CREDENTIAL_FILE: /run/secrets/nnm-wandb-credentials
-      NNM_WANDB_NETWORK: ${NNM_WANDB_NETWORK:-}
-      NNM_WANDB_PROXY_URL: ${NNM_WANDB_PROXY_URL:-}
+      NNM_WANDB_NETWORK: ${NNM_WANDB_NETWORK:-nnm-wandb-egress}
+      NNM_WANDB_PROXY_URL: ${NNM_WANDB_PROXY_URL:-http://10.89.42.2:3128}
       CONTAINER_HOST: ${NNM_CONTAINER_HOST:-unix:///run/podman/podman.sock}
       DOCKER_HOST: ${NNM_CONTAINER_HOST:-unix:///run/podman/podman.sock}
-    command: ["uv", "run", "python", "-m", "backend.container_controller", "serve", "/run/nnm/controller.sock", "@/run/secrets/nnm-controller-token", "/app/jobs", "/app/jobs", "${NNM_CONTAINER_ENGINE:-podman}"]
+    command:
+      - uv
+      - run
+      - python
+      - -m
+      - backend.container_controller
+      - serve
+      - /run/nnm/controller.sock
+      - "@/run/secrets/nnm-controller-token"
+      - ${NNM_HOST_JOBS:?set NNM_HOST_JOBS to the absolute host jobs directory}
+      - ${NNM_HOST_JOBS:?set NNM_HOST_JOBS to the absolute host jobs directory}
+      - "${NNM_CONTAINER_ENGINE:-podman}"
     volumes:
-      - backend-jobs:/app/jobs
-      - ${NNM_CONTAINER_DATA_ROOT:-../data}:/app/data:ro
+      - ${NNM_HOST_JOBS:?set NNM_HOST_JOBS to the absolute host jobs directory}:${NNM_HOST_JOBS}:rw
+      - ${NNM_HOST_DATA:?set NNM_HOST_DATA to the absolute host data directory}:${NNM_HOST_DATA}:ro
       - controller-socket:/run/nnm
-      - ${NNM_CONTAINER_CONTROLLER_TOKEN_FILE:-../valkey-data/controller.token}:/run/secrets/nnm-controller-token:ro
-      - ${NNM_WANDB_CREDENTIAL_FILE:-../valkey-data/wandb-credentials.json}:/run/secrets/nnm-wandb-credentials:ro
+      - ${NNM_HOST_CONTROLLER_TOKEN:?set NNM_HOST_CONTROLLER_TOKEN to the controller token path}:/run/secrets/nnm-controller-token:ro
+      - ${NNM_WANDB_CREDENTIAL_FILE:-../backend-secrets/wandb-credentials.json}:/run/secrets/nnm-wandb-credentials:ro
       # This is deliberately mounted only in the controller service.
-      - ${NNM_CONTAINER_ENGINE_SOCKET:-/run/user/1000/podman/podman.sock}:${NNM_CONTAINER_ENGINE_SOCKET_TARGET:-/run/podman/podman.sock}
-    depends_on:
-      valkey:
-        condition: service_healthy
+      - ${NNM_CONTAINER_ENGINE_SOCKET:-/run/user/1000/podman/podman.sock}:/run/podman/podman.sock
+    healthcheck:
+      test: ["CMD-SHELL", "test -S /run/nnm/controller.sock && podman info >/dev/null"]
+      interval: 2s
+      timeout: 3s
+      retries: 15
+    restart: unless-stopped
 
 volumes:
-  valkey-data:
-  backend-jobs:
   controller-socket:
diff --git a/converted/backend/justfile b/converted/backend/justfile
@@ -3,25 +3,32 @@ set shell := ["bash", "-cu"]
 backend_dir := justfile_directory()
 converted_dir := backend_dir / ".."
 valkey_data_dir := converted_dir / "valkey-data"
+backend_secrets_dir := converted_dir / "backend-secrets"
 valkey_port := env_var_or_default("NNM_VALKEY_PORT", "6379")
 api_host := env_var_or_default("NNM_BACKEND_HOST", "127.0.0.1")
 api_port := env_var_or_default("NNM_BACKEND_PORT", "8000")
 valkey_url := "valkey://127.0.0.1:" + valkey_port + "/0"
 uv_cache_dir := env_var_or_default("UV_CACHE_DIR", "/tmp/nnmodelling-uv-cache")
-admin_token_file := env_var_or_default("NNM_ADMIN_TOKEN_FILE", valkey_data_dir / "admin.token")
+admin_token_file := env_var_or_default("NNM_ADMIN_TOKEN_FILE", backend_secrets_dir / "admin.token")
 admin_url := env_var_or_default("NNM_ADMIN_URL", "http://127.0.0.1:" + api_port)
 container_engine := env_var_or_default("NNM_CONTAINER_ENGINE", "podman")
 container_image := env_var_or_default("NNM_CONTAINER_IMAGE", "")
 controller_socket := env_var_or_default("NNM_CONTAINER_CONTROLLER_SOCKET", "/tmp/nnm-controller/controller.sock")
-controller_token_file := env_var_or_default("NNM_CONTAINER_CONTROLLER_TOKEN_FILE", valkey_data_dir / "controller.token")
+controller_token_file := env_var_or_default("NNM_CONTAINER_CONTROLLER_TOKEN_FILE", backend_secrets_dir / "controller.token")
 container_data_root := env_var_or_default("NNM_CONTAINER_DATA_ROOT", converted_dir / "data")
-wandb_credentials_file := env_var_or_default("NNM_WANDB_CREDENTIAL_FILE", valkey_data_dir / "wandb-credentials.json")
+wandb_credentials_file := env_var_or_default("NNM_WANDB_CREDENTIAL_FILE", backend_secrets_dir / "wandb-credentials.json")
 wandb_network := env_var_or_default("NNM_WANDB_NETWORK", "")
 wandb_proxy_url := env_var_or_default("NNM_WANDB_PROXY_URL", "")
 
 default:
     @just --list
 
+# Build the package worker from this checkout and print its immutable reference.
+# The printed digest, not the mutable local tag, is the value for NNM_CONTAINER_IMAGE.
+worker-build tag="local":
+    podman build --file "{{backend_dir}}/Dockerfile" --tag "localhost/nnm-worker:{{tag}}" "{{converted_dir}}"
+    @podman image inspect --format '{{ "{{" }}.Digest{{ "}}" }}' "localhost/nnm-worker:{{tag}}" | sed 's#^#NNM_CONTAINER_IMAGE=localhost/nnm-worker@#'
+
 # Start Valkey in the foreground with persistent local data.
 valkey:
     mkdir -p "{{valkey_data_dir}}"
@@ -43,7 +50,7 @@ backend-unsafe-unlimited-dataset-size: admin-init
 # Start the trusted container controller separately. Only this process needs
 # access to the local Podman/Docker socket; FastAPI connects through its RPC.
 controller: admin-init
-    mkdir -p "$(dirname '{{controller_socket}}')" "{{valkey_data_dir}}"; if [[ ! -s "{{controller_token_file}}" ]]; then (umask 077; python -c 'import secrets; print(secrets.token_hex(32))' > "{{controller_token_file}}"); fi; cd "{{converted_dir}}"; UV_CACHE_DIR="{{uv_cache_dir}}" PYTHONPATH=src NNM_CONTAINER_DATA_ROOT="{{container_data_root}}" NNM_WANDB_CREDENTIAL_FILE="{{wandb_credentials_file}}" NNM_WANDB_NETWORK="{{wandb_network}}" NNM_WANDB_PROXY_URL="{{wandb_proxy_url}}" uv run python -m backend.container_controller serve "{{controller_socket}}" @"{{controller_token_file}}" "{{converted_dir}}/jobs" "{{converted_dir}}/jobs" "{{container_engine}}"
+    mkdir -p "$(dirname '{{controller_socket}}')" "{{backend_secrets_dir}}"; if [[ ! -s "{{controller_token_file}}" ]]; then (umask 077; python -c 'import secrets; print(secrets.token_hex(32))' > "{{controller_token_file}}"); fi; cd "{{converted_dir}}"; UV_CACHE_DIR="{{uv_cache_dir}}" PYTHONPATH=src NNM_CONTAINER_DATA_ROOT="{{container_data_root}}" NNM_WANDB_CREDENTIAL_FILE="{{wandb_credentials_file}}" NNM_WANDB_NETWORK="{{wandb_network}}" NNM_WANDB_PROXY_URL="{{wandb_proxy_url}}" uv run python -m backend.container_controller serve "{{controller_socket}}" @"{{controller_token_file}}" "{{converted_dir}}/jobs" "{{converted_dir}}/jobs" "{{container_engine}}"
 
 # Configure the shared administrator-owned W&B account. The command prompts
 # for the key and never accepts it as an argument.
@@ -108,6 +115,13 @@ test:
 docker-up: admin-init
     NNM_CONTAINER_ENGINE="{{container_engine}}" NNM_CONTAINER_IMAGE="{{container_image}}" docker compose -f "{{backend_dir}}/docker-compose.yml" up --build
 
+# Start the standard local Podman Compose deployment. This builds the worker
+# first and passes its immutable digest to the backend services.
+# For non-standard user requirements, the backend administrator should invoke
+# `podman compose` directly instead of using this standard `just compose` path.
+compose: worker-build admin-init
+    mkdir -p "$(dirname '{{controller_socket}}')" "{{backend_secrets_dir}}" "{{converted_dir}}/jobs" "{{container_data_root}}"; if [[ ! -s "{{controller_token_file}}" ]]; then (umask 077; python -c 'import secrets; print(secrets.token_hex(32))' > "{{controller_token_file}}"); fi; systemctl --user start podman.socket; NNM_CONTAINER_IMAGE="$(podman image inspect --format '{{ "{{" }}.Digest{{ "}}" }}' localhost/nnm-worker:local | sed 's#^#localhost/nnm-worker@#')" NNM_HOST_VALKEY_DATA="{{valkey_data_dir}}" NNM_HOST_JOBS="{{converted_dir}}/jobs" NNM_HOST_DATA="{{container_data_root}}" NNM_HOST_ADMIN_TOKEN="{{admin_token_file}}" NNM_HOST_CONTROLLER_TOKEN="{{controller_token_file}}" NNM_WANDB_CREDENTIAL_FILE="{{wandb_credentials_file}}" podman compose --project-name nnm-backend -f "{{backend_dir}}/docker-compose.yml" up --build -d
+
 # Stop the Docker deployment without deleting its volumes.
 docker-down:
     docker compose -f "{{backend_dir}}/docker-compose.yml" down

diff --git a/converted/pyproject.toml b/converted/pyproject.toml
@@ -12,6 +12,7 @@ dependencies = [
   "uvicorn[standard]>=0.30.0",
   "valkey>=6.0.0",
   "numpy>=1.24.0",
+  "pillow>=11.0.0",
   "safetensors>=0.7.0",
   "wandb>=0.22.3",
 ]