nanoclaw-public/docker-compose.yml at main · jbaruch/nanoclaw-public · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
services:
  nanoclaw:
    build:
      context: .
      dockerfile: Dockerfile.orchestrator
    container_name: nanoclaw
    restart: always
    volumes:
      # Docker socket for spawning sibling agent containers
      - /var/run/docker.sock:/var/run/docker.sock
      # Persistent data directories
      - ./store:/app/store
      - ./data:/app/data
      - ./groups:/app/groups
      - ./logs:/app/logs
      # Credentials (mounted, never baked into image)
      - ./.env:/app/.env:ro
      # Shared trusted directory (mounted into trusted + main agent containers)
      - ./trusted:/app/trusted
      # NanoClaw config (mount allowlist, sender allowlist)
      - ${HOME}/.config/nanoclaw:/root/.config/nanoclaw:ro
      # Tessl: credentials + persistent workspace for registry installs
      - ${HOME}/.tessl:/root/.tessl
      - ./tessl-workspace:/app/tessl-workspace
    environment:
      # Docker-out-of-Docker: mount paths must reference the HOST filesystem
      - HOST_PROJECT_ROOT=${HOST_PROJECT_ROOT:-.}
      # Host user UID/GID for agent container --user flag
      - HOST_UID=${HOST_UID:-1000}
      - HOST_GID=${HOST_GID:-1000}
      # Credential proxy binds to all interfaces so agent containers can reach it
      - CREDENTIAL_PROXY_HOST=0.0.0.0
      - TZ=America/Chicago
      - NODE_ENV=production
    ports:
      # Credential proxy — agent containers reach it via host.docker.internal:3001
      - "3001:3001"