# CodeCraft from the published image (amd64 and arm64) – no build needed.
#
#   curl -fsSLO https://git.familie-zink.org/zink/codecraft/raw/branch/main/docker-compose.release.yml
#   curl -fsSLO https://git.familie-zink.org/zink/codecraft/raw/branch/main/docker/seccomp-sandbox.json --create-dirs --output-dir docker
#   curl -fsSL  https://git.familie-zink.org/zink/codecraft/raw/branch/main/.env.example -o .env   # then edit .env
#   docker compose -f docker-compose.release.yml up -d
#   docker compose -f docker-compose.release.yml logs codecraft   # one-time setup code for the first admin
#
# Update: docker compose -f docker-compose.release.yml pull && docker compose -f docker-compose.release.yml up -d
#
# Persistent state lives in the named volume "codecraft-data" (mounted at /data):
#   /data/config.toml   configuration (also editable in the web UI)
#   /data/codecraft.db  sessions, messages, statistics
#   /data/backups       daily backups
#   /data/home          home directory of the agent (git config, caches, ...)
services:
  codecraft:
    # Pin a version (e.g. :0.1.0) or follow :latest.
    image: git.familie-zink.org/zink/codecraft:${CODECRAFT_VERSION:-latest}
    container_name: codecraft
    restart: unless-stopped
    # Same UID/GID as the owner of your project files.
    user: "${UID:-1000}:${GID:-1000}"
    # Bound to localhost by default: expose it through a TLS reverse proxy.
    # Set BIND_ADDR=0.0.0.0 to publish it on all interfaces.
    ports:
      - "${BIND_ADDR:-127.0.0.1}:${PORT:-8787}:8787"
    # All variables from .env are available to the config as ${NAME}
    # (provider keys, MCP tokens, OIDC secret, initial admin).
    env_file:
      - path: .env
        required: false
    volumes:
      - codecraft-data:/data
      # The projects the agents may work on.
      - ${WORKSPACE:-./workspace}:/workspace
    # Reach self-hosted models (Ollama, vLLM, ...) on the host.
    extra_hosts:
      - "host.docker.internal:host-gateway"
    shm_size: "1gb" # Chromium (craft mode, browser tool)
    # Shell commands of non-admin users run in a bubblewrap sandbox. It needs
    # user namespaces: a seccomp profile that adds exactly those syscalls to
    # Docker's default, AppArmor relaxed for the namespace mounts, and an
    # unmasked /proc so the sandbox can mount its own (hiding server processes).
    # Remove these three lines and set [sandbox] mode = "off" if you are the
    # only user.
    security_opt:
      - seccomp=./docker/seccomp-sandbox.json
      - apparmor=unconfined
      - systempaths=unconfined

volumes:
  codecraft-data:
    name: codecraft-data