docker-compose.yml

# ============================================================
# Code Execution Service - Docker Compose
# ============================================================
# Usage:
#   docker compose --profile local-docker build    # Local development build
#   docker compose --profile local-docker up -d    # Start the local gateway stack
#   docker compose --profile local-docker logs -f  # View local logs
#   docker compose --profile local-docker down     # Stop the local stack
# ============================================================

services:
  docker-proxy:
    profiles:
      - local-docker
    image: ghcr.io/tecnativa/docker-socket-proxy:v0.4.1
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /run:rw,noexec,nosuid,nodev,size=1m
      - /tmp:rw,noexec,nosuid,nodev,size=8m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - LOG_LEVEL=warning
      - EVENTS=0
      - POST=1
      - CONTAINERS=1
      - ALLOW_START=1
      - ALLOW_RESTARTS=1
      - EXEC=1
      - IMAGES=1
      - INFO=1
    healthcheck:
      test: [ "CMD", "wget", "-q", "-O", "-", "http://localhost:2375/_ping" ]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 5s
    networks:
      - control-plane

  redis:
    image: redis:7.4.2-alpine
    user: "999:999"
    restart: unless-stopped
    command: [ "redis-server", "--save", "", "--appendonly", "yes", "--appendfsync", "everysec" ]
    volumes:
      - redis-data:/data
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    healthcheck:
      test: [ "CMD", "redis-cli", "ping" ]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 5s
    networks:
      - control-plane

  # --- API Gateway ---
  gateway:
    image: code-gateway:latest
    build:
      context: ./gateway
      dockerfile: Dockerfile
      args:
        PYTHON_BASE_IMAGE: ${PYTHON_BASE_IMAGE:-python:3.12-slim-bookworm@sha256:dba9a3ac4914b5ae6f790188ff39267e46e0087fa0f4713592b5d32350edb5ef}
    container_name: code-execution-gateway
    restart: unless-stopped
    depends_on:
      redis:
        condition: service_healthy
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=64m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 256
    ports:
      - "${GATEWAY_PORT:-8000}:8000"
    volumes:
      - ./.env_sandbox:/etc/code-execution/.env_sandbox:ro
    environment:
      - APP_ENV=${APP_ENV:-development}
      - REQUIRE_AUTH=${REQUIRE_AUTH:-true}
      - METRICS_AUTH_REQUIRED=${METRICS_AUTH_REQUIRED:-true}
      - REQUIRE_SHARED_STATE=${REQUIRE_SHARED_STATE:-true}
      - REDIS_SOCKET_CONNECT_TIMEOUT=${REDIS_SOCKET_CONNECT_TIMEOUT:-5}
      - REDIS_SOCKET_TIMEOUT=${REDIS_SOCKET_TIMEOUT:-5}
      - REDIS_HEALTH_CHECK_INTERVAL=${REDIS_HEALTH_CHECK_INTERVAL:-30}
      - SANDBOX_IMAGE=${SANDBOX_IMAGE:-code-sandbox:latest}
      - SANDBOX_USER=${SANDBOX_USER:-sandbox}
      - MAX_REQUEST_BODY_SIZE=${MAX_REQUEST_BODY_SIZE:-33554432}
      - MAX_INPUT_FILES=${MAX_INPUT_FILES:-10}
      - MAX_INPUT_FILE_SIZE=${MAX_INPUT_FILE_SIZE:-5242880}
      - MAX_INPUT_TOTAL_SIZE=${MAX_INPUT_TOTAL_SIZE:-20971520}
      - MAX_FILE_NAME_LENGTH=${MAX_FILE_NAME_LENGTH:-128}
      - MAX_CONCURRENT_EXECUTIONS=${MAX_CONCURRENT_EXECUTIONS:-10}
      - MAX_ACTIVE_SESSIONS=${MAX_ACTIVE_SESSIONS:-100}
      - MAX_CONTAINERS_PER_PRINCIPAL=${MAX_CONTAINERS_PER_PRINCIPAL:-3}
      - CONTAINER_CREATE_GUARD_TIMEOUT=${CONTAINER_CREATE_GUARD_TIMEOUT:-30}
      - SESSION_TIMEOUT_SECONDS=${SESSION_TIMEOUT_SECONDS:-1200}
      - MAX_SESSION_LIFETIME_SECONDS=${MAX_SESSION_LIFETIME_SECONDS:-3600}
      - MAX_EXECUTIONS_PER_SESSION=${MAX_EXECUTIONS_PER_SESSION:-100}
      - DEFAULT_TIMEOUT=${DEFAULT_TIMEOUT:-30}
      - MAX_TIMEOUT=${MAX_TIMEOUT:-120}
      - RATE_LIMIT_REQUESTS_PER_WINDOW=${RATE_LIMIT_REQUESTS_PER_WINDOW:-30}
      - RATE_LIMIT_WINDOW_SECONDS=${RATE_LIMIT_WINDOW_SECONDS:-60}
      - CONTAINER_RATE_LIMIT_REQUESTS_PER_WINDOW=${CONTAINER_RATE_LIMIT_REQUESTS_PER_WINDOW:-10}
      - CONTAINER_RATE_LIMIT_WINDOW_SECONDS=${CONTAINER_RATE_LIMIT_WINDOW_SECONDS:-60}
      - SANDBOX_MEM_LIMIT=${SANDBOX_MEM_LIMIT:-512m}
      - SANDBOX_CPU_PERIOD=${SANDBOX_CPU_PERIOD:-100000}
      - SANDBOX_CPU_QUOTA=${SANDBOX_CPU_QUOTA:-100000}
      - SANDBOX_PIDS_LIMIT=${SANDBOX_PIDS_LIMIT:-256}
      - SANDBOX_TMP_ROOT_SIZE=${SANDBOX_TMP_ROOT_SIZE:-512m}
      - SANDBOX_SHM_SIZE=${SANDBOX_SHM_SIZE:-128m}
      - SANDBOX_HOME_TMPFS_SIZE=${SANDBOX_HOME_TMPFS_SIZE:-256m}
      - SANDBOX_READ_ONLY_ROOTFS=${SANDBOX_READ_ONLY_ROOTFS:-true}
      - SANDBOX_NETWORK_MODE=${SANDBOX_NETWORK_MODE:-none}
      - SANDBOX_UID=${SANDBOX_UID:-10001}
      - SANDBOX_GID=${SANDBOX_GID:-10001}
      - ALLOW_PIP_INSTALLS=${ALLOW_PIP_INSTALLS:-false}
      - MAX_PIP_PACKAGES=${MAX_PIP_PACKAGES:-5}
      - MAX_PIP_PACKAGE_NAME_LENGTH=${MAX_PIP_PACKAGE_NAME_LENGTH:-64}
      - SLIDE_RENDERING_VERSION=${SLIDE_RENDERING_VERSION:-v1}
      - RENDER_TIMEOUT_SECONDS=${RENDER_TIMEOUT_SECONDS:-180}
      - RENDER_QUEUE_TIMEOUT_MS=${RENDER_QUEUE_TIMEOUT_MS:-500}
      - PAGE_LOAD_TIMEOUT_MS=${PAGE_LOAD_TIMEOUT_MS:-30000}
      - MAX_CONCURRENT_RENDERS=${MAX_CONCURRENT_RENDERS:-2}
      - RENDER_RATE_LIMIT_REQUESTS_PER_WINDOW=${RENDER_RATE_LIMIT_REQUESTS_PER_WINDOW:-10}
      - RENDER_RATE_LIMIT_WINDOW_SECONDS=${RENDER_RATE_LIMIT_WINDOW_SECONDS:-60}
      - RENDER_MAX_REQUEST_BODY_BYTES=${RENDER_MAX_REQUEST_BODY_BYTES:-180000000}
      - RENDER_MAX_HTML_CHARS=${RENDER_MAX_HTML_CHARS:-2000000}
      - RENDER_MAX_INPUT_FILES=${RENDER_MAX_INPUT_FILES:-32}
      - RENDER_MAX_SLIDES=${RENDER_MAX_SLIDES:-200}
      - RENDER_MAX_ASSET_BYTES=${RENDER_MAX_ASSET_BYTES:-25000000}
      - RENDER_MAX_TOTAL_ASSET_BYTES=${RENDER_MAX_TOTAL_ASSET_BYTES:-120000000}
      - RENDER_MAX_OUTPUT_BYTES=${RENDER_MAX_OUTPUT_BYTES:-220000000}
      - RENDER_SANDBOX_MEM_LIMIT=${RENDER_SANDBOX_MEM_LIMIT:-2g}
      - RENDER_SANDBOX_CPU_PERIOD=${RENDER_SANDBOX_CPU_PERIOD:-100000}
      - RENDER_SANDBOX_CPU_QUOTA=${RENDER_SANDBOX_CPU_QUOTA:-200000}
      - RENDER_SANDBOX_PIDS_LIMIT=${RENDER_SANDBOX_PIDS_LIMIT:-512}
      - RENDER_SANDBOX_TMP_ROOT_SIZE=${RENDER_SANDBOX_TMP_ROOT_SIZE:-1g}
      - RENDER_SANDBOX_SHM_SIZE=${RENDER_SANDBOX_SHM_SIZE:-512m}
      - RENDER_SANDBOX_HOME_TMPFS_SIZE=${RENDER_SANDBOX_HOME_TMPFS_SIZE:-256m}
      - DOCKER_CLIENT_TIMEOUT=${DOCKER_CLIENT_TIMEOUT:-30}
      - SANDBOX_RUNTIME=${SANDBOX_RUNTIME:-}
      - STRONG_SANDBOX_RUNTIMES=${STRONG_SANDBOX_RUNTIMES:-runsc,kata,kata-runtime,io.containerd.runsc.v1,io.containerd.kata.v2}
      - REQUIRE_STRONG_SANDBOX_ISOLATION=${REQUIRE_STRONG_SANDBOX_ISOLATION:-false}
      - USE_DOCKER_DEFAULT_SECCOMP=${USE_DOCKER_DEFAULT_SECCOMP:-true}
      - SECCOMP_PROFILE_DAEMON_PATH=${SECCOMP_PROFILE_DAEMON_PATH:-}
      - ALLOW_SANDBOX_ENV_INJECTION=${ALLOW_SANDBOX_ENV_INJECTION:-false}
      - DOCKER_HOST=${GATEWAY_DOCKER_HOST:-tcp://docker-proxy:2375}
      - REDIS_URL=${REDIS_URL:-redis://redis:6379/0}
      - SANDBOX_ENV_TARGET_PATH=${SANDBOX_ENV_TARGET_PATH:-/home/sandbox/.env}
      - SANDBOX_ENV_SOURCE_PATH=/etc/code-execution/.env_sandbox
      - FILE_PROVISION_TIMEOUT=${FILE_PROVISION_TIMEOUT:-30}
      - LOG_LEVEL=${LOG_LEVEL:-INFO}
      - PUBLIC_BETA_MODE=${PUBLIC_BETA_MODE:-}
      - ENABLE_DOCS=${ENABLE_DOCS:-false}
      - ENABLE_CORS=${ENABLE_CORS:-true}
      - CORS_ALLOW_ORIGINS=${CORS_ALLOW_ORIGINS:-http://localhost:3000}
      - CORS_ALLOW_METHODS=${CORS_ALLOW_METHODS:-GET,POST,DELETE,OPTIONS}
      - CORS_ALLOW_HEADERS=${CORS_ALLOW_HEADERS:-Authorization,Content-Type,X-Request-ID,X-API-Key}
      - CORS_ALLOW_CREDENTIALS=${CORS_ALLOW_CREDENTIALS:-true}
      - ALLOWED_HOSTS=${ALLOWED_HOSTS:-127.0.0.1,localhost}
      - RENDER_ALLOWED_HOSTS=${RENDER_ALLOWED_HOSTS:-127.0.0.1,localhost}
      - ALLOW_INSECURE_PRODUCTION_CONFIGURATION=${ALLOW_INSECURE_PRODUCTION_CONFIGURATION:-}
      - RENDER_ALLOW_INSECURE_PRODUCTION_CONFIGURATION=${RENDER_ALLOW_INSECURE_PRODUCTION_CONFIGURATION:-}
      - API_KEYS=${API_KEYS:-}
      - API_KEY=${API_KEY:-}
      - JWT_SECRET=${JWT_SECRET:-}
      - JWT_ALGORITHMS=${JWT_ALGORITHMS:-HS256}
      - JWT_ISSUER=${JWT_ISSUER:-}
      - JWT_AUDIENCE=${JWT_AUDIENCE:-}
      - JWT_TENANT_CLAIM=${JWT_TENANT_CLAIM:-tenant_id}
    healthcheck:
      test: [ "CMD", "curl", "-f", "http://localhost:8000/healthz" ]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    networks:
      - default
      - control-plane

  # --- Sandbox Image Builder ---
  # This service only builds the sandbox image; it doesn't run.
  sandbox:
    image: code-sandbox:latest
    build:
      context: ./sandbox
      dockerfile: Dockerfile
      args:
        PYTHON_BASE_IMAGE: ${PYTHON_BASE_IMAGE:-python:3.12-slim-bookworm@sha256:dba9a3ac4914b5ae6f790188ff39267e46e0087fa0f4713592b5d32350edb5ef}
    entrypoint: [ "echo", "Sandbox image built successfully" ]
    profiles:
      - build

networks:
  control-plane:
    internal: true

volumes:
  redis-data: