ai-docker-stack/compose.security.yaml at master · xormania/ai-docker-stack · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
name: ai-docker-stack

networks:
  # Existing/default app network is used for internal service access.
  # Agent also joins an internal-only network that has no external route.
  agent_internal:
    name: ${AGENT_INTERNAL_NETWORK:-agent_internal}
    internal: true

services:
  squid:
    image: ${SQUID_IMAGE:-sameersbn/squid:3.5.27-2}
    container_name: ${SQUID_CONTAINER_NAME:-squid}
    restart: unless-stopped
    networks:
      - default
      - agent_internal
    volumes:
      - ./security/squid.conf:/etc/squid/squid.conf:ro
      - squid-cache:/var/spool/squid
      - squid-log:/var/log/squid
    read_only: true
    tmpfs:
      - /run
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
      - SETGID
      - SETUID
    healthcheck:
      test: ["CMD-SHELL", "nc -z 127.0.0.1 3128 || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 5

  # Hardened override for OpenClaw.
  # IMPORTANT: only attach to agent_internal so it cannot egress directly.
  # It should reach stack services through hostnames resolved via extra_hosts below.
  openclaw:
    depends_on:
      squid:
        condition: service_healthy
    networks:
      - agent_internal
    environment:
      OPENCLAW_EGRESS_MODE: ${OPENCLAW_EGRESS_MODE:-allowlist}
      OPENCLAW_SANDBOX_MODE: ${OPENCLAW_SANDBOX_MODE:-docker-sandbox}
      HTTP_PROXY: http://squid:3128
      HTTPS_PROXY: http://squid:3128
      ALL_PROXY: http://squid:3128
      NO_PROXY: localhost,127.0.0.1,squid
      # Point service URLs at the host-published ports instead of docker DNS names
      OLLAMA_BASE_URL: http://host.docker.internal:${OLLAMA_PORT:-11434}
      QDRANT_URL: http://host.docker.internal:${QDRANT_HTTP_PORT:-6333}
      REDIS_URL: redis://:${REDIS_PASSWORD}@host.docker.internal:${REDIS_PORT:-6379}
      POSTGRES_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@host.docker.internal:${POSTGRES_PORT:-5432}/${POSTGRES_DB}
      MYSQL_URL: mysql://${MYSQL_USER}:${MYSQL_PASSWORD}@host.docker.internal:${MYSQL_PORT:-3306}/${MYSQL_DATABASE}
      MINIO_ENDPOINT: http://host.docker.internal:${MINIO_API_PORT:-9000}
      GITEA_BASE_URL: http://host.docker.internal:${GITEA_HTTP_PORT:-3001}
      N8N_BASE_URL: http://host.docker.internal:${N8N_PORT:-5678}
      MERCURE_URL: http://host.docker.internal:${MERCURE_PORT:-8080}
      SURREALDB_URL: ws://host.docker.internal:${SURREALDB_PORT:-8000}/rpc
      COUCHDB_URL: http://${COUCHDB_USER}:${COUCHDB_PASSWORD}@host.docker.internal:${COUCHDB_PORT:-5984}
      SEARXNG_BASE_URL: http://host.docker.internal:${SEARXNG_PORT:-8080}
      UNSTRUCTURED_API_URL: http://host.docker.internal:${UNSTRUCTURED_API_PORT:-8001}
    extra_hosts:
      - "host.docker.internal:host-gateway"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
      - /run
    pids_limit: 512
    mem_limit: ${OPENCLAW_MEM_LIMIT:-2g}
    cpus: ${OPENCLAW_CPUS:-2.0}

  # Hardened override for OpenHands with same pattern.
  openhands:
    depends_on:
      squid:
        condition: service_healthy
    networks:
      - agent_internal
    environment:
      OPENHANDS_ENABLE_DOCKER_SOCKET: "false"
      HTTP_PROXY: http://squid:3128
      HTTPS_PROXY: http://squid:3128
      ALL_PROXY: http://squid:3128
      NO_PROXY: localhost,127.0.0.1,squid
    extra_hosts:
      - "host.docker.internal:host-gateway"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp
      - /run
    pids_limit: 512
    mem_limit: ${OPENHANDS_MEM_LIMIT:-2g}
    cpus: ${OPENHANDS_CPUS:-2.0}

volumes:
  squid-cache:
  squid-log: