common-services.yaml

---
services:
  fiftyone-app-common:
    image: voxel51/fiftyone-app:v2.21.0
    environment:
      API_URL: ${API_URL}
      FIFTYONE_APP_DEFAULT_QUERY_PERFORMANCE: ${FIFTYONE_APP_DEFAULT_QUERY_PERFORMANCE}
      FIFTYONE_APP_ENABLE_QUERY_PERFORMANCE: ${FIFTYONE_APP_ENABLE_QUERY_PERFORMANCE}
      FIFTYONE_AUTH_SECRET: ${FIFTYONE_AUTH_SECRET}
      FIFTYONE_DATABASE_ADMIN: false
      FIFTYONE_DATABASE_NAME: ${FIFTYONE_DATABASE_NAME}
      FIFTYONE_DATABASE_URI: ${FIFTYONE_DATABASE_URI}
      FIFTYONE_DEFAULT_APP_ADDRESS: 0.0.0.0
      FIFTYONE_DEFAULT_APP_PORT: 5151
      FIFTYONE_ENCRYPTION_KEY: ${FIFTYONE_ENCRYPTION_KEY}
      FIFTYONE_INTERNAL_SERVICE: true
      FIFTYONE_MEDIA_CACHE_APP_IMAGES: false
      FIFTYONE_MEDIA_CACHE_SIZE_BYTES: -1
      FIFTYONE_SIGNED_URL_EXPIRATION: ${FIFTYONE_SIGNED_URL_EXPIRATION:-24}
      FIFTYONE_TELEMETRY_REDIS_URL: ${FIFTYONE_TELEMETRY_REDIS_URL:-redis://telemetry-redis:6379}
      # If you are routing through a proxy server you will want to set
      #  HTTP_PROXY_URL, HTTPS_PROXY_URL, and NO_PROXY_LIST in your .env
      #  then add the following environment variables to your
      #  `compose.override.yaml`
      # HTTPS_PROXY: ${HTTPS_PROXY_URL}
      # HTTP_PROXY: ${HTTP_PROXY_URL}
      # NO_PROXY: ${NO_PROXY_LIST}
      # http_proxy: ${HTTP_PROXY_URL}
      # https_proxy: ${HTTPS_PROXY_URL}
      # no_proxy: ${NO_PROXY_LIST}
    ports:
      - ${FIFTYONE_DEFAULT_APP_ADDRESS}:${FIFTYONE_DEFAULT_APP_PORT}:5151
    restart: always

  teams-api-common:
    image: voxel51/fiftyone-teams-api:v2.21.0
    environment:
      API_EXTERNAL_URL: ${FIFTYONE_API_URI}
      CAS_BASE_URL: ${CAS_BASE_URL:-http://teams-cas:3000/cas/api}
      FIFTYONE_AUTH_SECRET: ${FIFTYONE_AUTH_SECRET}
      FIFTYONE_DATABASE_NAME: ${FIFTYONE_DATABASE_NAME}
      FIFTYONE_DATABASE_URI: ${FIFTYONE_DATABASE_URI}
      FIFTYONE_ENCRYPTION_KEY: ${FIFTYONE_ENCRYPTION_KEY}
      FIFTYONE_ENV: ${FIFTYONE_ENV}
      FIFTYONE_INTERNAL_SERVICE: true
      FIFTYONE_LOGGING_FORMAT: ${FIFTYONE_LOGGING_FORMAT:-text}
      FIFTYONE_TELEMETRY_REDIS_URL: ${FIFTYONE_TELEMETRY_REDIS_URL:-redis://telemetry-redis:6379}
      GRAPHQL_DEFAULT_LIMIT: ${GRAPHQL_DEFAULT_LIMIT}
      LOGGING_LEVEL: ${API_LOGGING_LEVEL:-INFO}
      MONGO_DEFAULT_DB: ${FIFTYONE_DATABASE_NAME}
      # If you are routing through a proxy server you will want to set
      #  HTTP_PROXY_URL, HTTPS_PROXY_URL, and NO_PROXY_LIST in your .env
      #  then add the following environment variables to your
      #  `compose.override.yaml`
      # HTTPS_PROXY: ${HTTPS_PROXY_URL}
      # HTTP_PROXY: ${HTTP_PROXY_URL}
      # NO_PROXY: ${NO_PROXY_LIST}
      # http_proxy: ${HTTP_PROXY_URL}
      # https_proxy: ${HTTPS_PROXY_URL}
      # no_proxy: ${NO_PROXY_LIST}
    ports:
      - ${API_BIND_ADDRESS}:${API_BIND_PORT}:8000
    restart: always

  teams-app-common:
    image: voxel51/fiftyone-teams-app:v2.21.0
    environment:
      API_URL: ${API_URL}
      APP_USE_HTTPS: ${APP_USE_HTTPS:-true}
      FIFTYONE_API_URI: ${FIFTYONE_API_URI:-"Please contact your Admin for an API URI"}
      FIFTYONE_APP_ALLOW_MEDIA_EXPORT: ${FIFTYONE_APP_ALLOW_MEDIA_EXPORT:-true}
      FIFTYONE_APP_TEAMS_SDK_RECOMMENDED_VERSION: 2.21.0
      FIFTYONE_AUTH_SECRET: ${FIFTYONE_AUTH_SECRET}
      FIFTYONE_SERVER_ADDRESS: ""
      FIFTYONE_SERVER_PATH_PREFIX: /api/proxy/fiftyone-teams
      FIFTYONE_TEAMS_PROXY_URL: ${FIFTYONE_TEAMS_PROXY_URL}
      FIFTYONE_TELEMETRY_REDIS_URL: ${FIFTYONE_TELEMETRY_REDIS_URL:-redis://telemetry-redis:6379}
      NODE_ENV: production
      RECOIL_DUPLICATE_ATOM_KEY_CHECKING_ENABLED: false
      FIFTYONE_APP_ANONYMOUS_ANALYTICS_ENABLED: ${FIFTYONE_APP_ANONYMOUS_ANALYTICS_ENABLED:-true}
      FIFTYONE_APP_DEPLOYMENT_CHARACTERISTICS: docker
      # If you are routing through a proxy server you will want to set
      #  HTTP_PROXY_URL, HTTPS_PROXY_URL, and NO_PROXY_LIST in your .env
      #  then add the following environment variables to your
      #  `compose.override.yaml`
      # GLOBAL_AGENT_HTTPS_PROXY: ${HTTPS_PROXY_URL}
      # GLOBAL_AGENT_HTTP_PROXY: ${HTTP_PROXY_URL}
      # GLOBAL_AGENT_NO_PROXY: ${NO_PROXY_LIST}
      # HTTPS_PROXY: ${HTTPS_PROXY_URL}
      # HTTP_PROXY: ${HTTP_PROXY_URL}
      # NO_PROXY: ${NO_PROXY_LIST}
      # ROARR_LOG: false
      # http_proxy: ${HTTP_PROXY_URL}
      # https_proxy: ${HTTPS_PROXY_URL}
      # no_proxy: ${NO_PROXY_LIST}
    ports:
      - ${APP_BIND_ADDRESS}:${APP_BIND_PORT}:3000
    restart: always

  teams-cas-common:
    image: voxel51/fiftyone-teams-cas:v2.21.0
    environment:
      CAS_DATABASE_NAME: ${CAS_DATABASE_NAME:-cas}
      CAS_DEFAULT_USER_ROLE: ${CAS_DEFAULT_USER_ROLE:-GUEST}
      CAS_MONGODB_URI: ${CAS_MONGO_DB_URI:-$FIFTYONE_DATABASE_URI}
      DEBUG: ${CAS_DEBUG:-cas:*,-cas:*:debug}
      FIFTYONE_AUTH_SECRET: ${FIFTYONE_AUTH_SECRET}
      LICENSE_KEY_FILE_PATHS: ${LICENSE_KEY_FILE_PATHS:-/opt/fiftyone/licenses/license}
      TEAMS_API_DATABASE_NAME: ${FIFTYONE_DATABASE_NAME}
      TEAMS_API_MONGODB_URI: ${FIFTYONE_DATABASE_URI}
      FIFTYONE_ENCRYPTION_KEY: ${FIFTYONE_ENCRYPTION_KEY}
      # If you are routing through a proxy server you will want to set
      #  HTTP_PROXY_URL, HTTPS_PROXY_URL, and NO_PROXY_LIST in your .env
      #  then add the following environment variables to your
      #  `compose.override.yaml`
      # GLOBAL_AGENT_HTTPS_PROXY: ${HTTPS_PROXY_URL}
      # GLOBAL_AGENT_HTTP_PROXY: ${HTTP_PROXY_URL}
      # GLOBAL_AGENT_NO_PROXY: ${NO_PROXY_LIST}
      # HTTPS_PROXY: ${HTTPS_PROXY_URL}
      # HTTP_PROXY: ${HTTP_PROXY_URL}
      # NO_PROXY: ${NO_PROXY_LIST}
      # ROARR_LOG: false
      # http_proxy: ${HTTP_PROXY_URL}
      # https_proxy: ${HTTPS_PROXY_URL}
      # no_proxy: ${NO_PROXY_LIST}
    ports:
      - ${CAS_BIND_ADDRESS:-127.0.0.1}:${CAS_BIND_PORT:-3030}:3000
    restart: always
    volumes:
      - type: bind
        source: ${LOCAL_LICENSE_FILE_DIR}
        target: /opt/fiftyone/licenses
        read_only: true

  teams-plugins-common:
    image: voxel51/fiftyone-app-torch:v2.21.0
    environment:
      API_URL: ${API_URL}
      FIFTYONE_AUTH_SECRET: ${FIFTYONE_AUTH_SECRET}
      FIFTYONE_DATABASE_ADMIN: false
      FIFTYONE_DATABASE_NAME: ${FIFTYONE_DATABASE_NAME}
      FIFTYONE_DATABASE_URI: ${FIFTYONE_DATABASE_URI}
      FIFTYONE_DEFAULT_APP_ADDRESS: 0.0.0.0
      FIFTYONE_DEFAULT_APP_PORT: 5151
      FIFTYONE_ENCRYPTION_KEY: ${FIFTYONE_ENCRYPTION_KEY}
      FIFTYONE_INTERNAL_SERVICE: true
      FIFTYONE_MEDIA_CACHE_APP_IMAGES: false
      FIFTYONE_MEDIA_CACHE_SIZE_BYTES: -1
      FIFTYONE_PLUGINS_DIR: /opt/plugins
      FIFTYONE_TELEMETRY_REDIS_URL: ${FIFTYONE_TELEMETRY_REDIS_URL:-redis://telemetry-redis:6379}
      # If you are routing through a proxy server you will want to set
      #  HTTP_PROXY_URL, HTTPS_PROXY_URL, and NO_PROXY_LIST in your .env
      #  then add the following environment variables to your
      #  `compose.override.yaml`
      # HTTPS_PROXY: ${HTTPS_PROXY_URL}
      # HTTP_PROXY: ${HTTP_PROXY_URL}
      # NO_PROXY: ${NO_PROXY_LIST}
      # http_proxy: ${HTTP_PROXY_URL}
      # https_proxy: ${HTTPS_PROXY_URL}
      # no_proxy: ${NO_PROXY_LIST}
    restart: always

  teams-do-common:
    image: voxel51/fiftyone-teams-cv-full:v2.21.0
    # Telemetry default-on requires teams-do to share its PID namespace
    # with a single sidecar (compose's `pid: "service:<name>"` only joins
    # one replica). Force replicas=1 to keep the 1:1 pairing deterministic.
    # See docker/docs/configuring-telemetry.md for multi-worker patterns.
    deploy:
      replicas: 1
    command: >
      /bin/sh -c "fiftyone delegated launch -t remote -m"
    environment:
      API_URL: ${API_URL}
      FIFTYONE_DATABASE_ADMIN: false
      FIFTYONE_DATABASE_NAME: ${FIFTYONE_DATABASE_NAME}
      FIFTYONE_DATABASE_URI: ${FIFTYONE_DATABASE_URI}
      FIFTYONE_ENCRYPTION_KEY: ${FIFTYONE_ENCRYPTION_KEY}
      FIFTYONE_INTERNAL_SERVICE: true
      FIFTYONE_MEDIA_CACHE_SIZE_BYTES: -1
      FIFTYONE_PLUGINS_DIR: /opt/plugins
      FIFTYONE_TELEMETRY_REDIS_URL: ${FIFTYONE_TELEMETRY_REDIS_URL:-redis://telemetry-redis:6379}
      TELEMETRY_SOCKET: /tmp/telemetry/agent.sock
    restart: always
    volumes:
      - plugins-vol:/opt/plugins:ro
      - telemetry-socket:/tmp/telemetry

  telemetry-redis-common:
    image: ${TELEMETRY_REDIS_IMAGE:-redis:7-alpine}
    command:
      - redis-server
      - --save
      - "60"
      - "1"
      - --dir
      - /data
      - --maxmemory
      - ${TELEMETRY_REDIS_MAXMEMORY:-400mb}
      - --maxmemory-policy
      - allkeys-lru
    restart: always
    deploy:
      resources:
        limits:
          cpus: "0.25"
          memory: 512M
        reservations:
          cpus: "0.10"
          memory: 256M
    volumes:
      - telemetry-redis-data:/data

  # One sidecar per observed service. `pid: "service:<target>"` joins the
  # target's PID namespace so the sidecar can read /proc/<pid>/fd/1 and
  # psutil can see the target's process.
  fiftyone-app-telemetry-common:
    image: voxel51/telemetry-sidecar:v2.21.0
    pid: "service:fiftyone-app"
    # Matches the workload image's USER 1000:1000 so the kernel's
    # ptrace_may_access() check on /proc/<workload-pid>/fd/1 reads passes via the
    # same-UID fast path to allow for log tailing
    user: "1000:1000"
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    environment:
      POD_NAME: fiftyone-app
      POD_NAMESPACE: ${TELEMETRY_NAMESPACE:-docker}
      SERVICE_TYPE: fiftyone-app
      TARGET_NAME: ${FIFTYONE_APP_TARGET_NAME:-hypercorn}
      FIFTYONE_TELEMETRY_REDIS_URL: ${FIFTYONE_TELEMETRY_REDIS_URL:-redis://telemetry-redis:6379}
    deploy:
      resources:
        limits:
          cpus: "0.20"
          memory: 512M
        reservations:
          cpus: "0.20"
          memory: 512M
    restart: always

  teams-api-telemetry-common:
    image: voxel51/telemetry-sidecar:v2.21.0
    pid: "service:teams-api"
    user: "1000:1000"
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    environment:
      POD_NAME: teams-api
      POD_NAMESPACE: ${TELEMETRY_NAMESPACE:-docker}
      SERVICE_TYPE: teams-api
      TARGET_NAME: ${TEAMS_API_TARGET_NAME:-fiftyone-teams-api}
      FIFTYONE_TELEMETRY_REDIS_URL: ${FIFTYONE_TELEMETRY_REDIS_URL:-redis://telemetry-redis:6379}
    deploy:
      resources:
        limits:
          cpus: "0.10"
          memory: 512M
        reservations:
          cpus: "0.10"
          memory: 512M
    restart: always

  teams-plugins-telemetry-common:
    image: voxel51/telemetry-sidecar:v2.21.0
    pid: "service:teams-plugins"
    user: "1000:1000"
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    environment:
      POD_NAME: teams-plugins
      POD_NAMESPACE: ${TELEMETRY_NAMESPACE:-docker}
      SERVICE_TYPE: teams-plugins
      TARGET_NAME: ${TEAMS_PLUGINS_TARGET_NAME:-hypercorn}
      FIFTYONE_TELEMETRY_REDIS_URL: ${FIFTYONE_TELEMETRY_REDIS_URL:-redis://telemetry-redis:6379}
    deploy:
      resources:
        limits:
          cpus: "0.20"
          memory: 512M
        reservations:
          cpus: "0.20"
          memory: 512M
    restart: always

  teams-do-telemetry-common:
    image: voxel51/telemetry-sidecar:v2.21.0
    pid: "service:teams-do"
    user: "1000:1000"
    cap_drop:
      - ALL
    cap_add:
      - SYS_PTRACE  # allows for additional profiling metrics (sampled stacks via py-spy)
    security_opt:
      - no-new-privileges:true
    environment:
      POD_NAME: teams-do
      POD_NAMESPACE: ${TELEMETRY_NAMESPACE:-docker}
      SERVICE_TYPE: delegated-operator
      TARGET_NAME: ${TEAMS_DO_TARGET_NAME:-fiftyone delegated}
      EXECUTOR_SIDECAR: "true"
      TELEMETRY_SOCKET: /tmp/telemetry/agent.sock
      FIFTYONE_TELEMETRY_REDIS_URL: ${FIFTYONE_TELEMETRY_REDIS_URL:-redis://telemetry-redis:6379}
      FIFTYONE_DATABASE_URI: ${FIFTYONE_DATABASE_URI}
      FIFTYONE_DATABASE_NAME: ${FIFTYONE_DATABASE_NAME}
    deploy:
      resources:
        limits:
          cpus: "0.10"
          memory: 512M
        reservations:
          cpus: "0.10"
          memory: 512M
    volumes:
      - telemetry-socket:/tmp/telemetry
    restart: always