64 lines
3.0 KiB
YAML
64 lines
3.0 KiB
YAML
services:
|
|
maestro:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
image: maestro:latest
|
|
container_name: maestro
|
|
restart: unless-stopped
|
|
# Headed Chromium (display_mode: novnc) crashes with Docker's default 64MB
|
|
# /dev/shm. Give it room so the Browser tab / InteractiveBrowse / CAPTCHA
|
|
# pool work. Harmless when display_mode is headless.
|
|
shm_size: "1gb"
|
|
ports:
|
|
# Published on ALL host interfaces so a Docker host is reachable from your
|
|
# LAN out of the box (the common case for a headless server). Because the
|
|
# agent API includes the Bash tool, an UNAUTHENTICATED instance on the
|
|
# network is effectively remote code execution — so a FRESH install that
|
|
# binds a non-loopback interface now boots WITH a login: it generates an
|
|
# admin account and prints the password at startup (#1024, see
|
|
# src/bridge/initial-admin.ts and docs/docker.md "Quick start"). That is
|
|
# the floor, not a finished setup: also set `safety.bash_sandbox: always`
|
|
# and terminate TLS before a shared/untrusted network. To keep it
|
|
# local-only instead, change this to "127.0.0.1:9876:9876".
|
|
- "9876:9876"
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
# .env is optional: a bare `docker compose up --build` works with zero setup.
|
|
# Put overrides here (OLLAMA_*, auth secrets, HOST, ...) to inject them into
|
|
# the container — copy .env.example to .env and edit. `required: false` stops
|
|
# a fresh clone (no .env) from failing with "env file .env not found".
|
|
# Needs Docker Compose v2.24+ (Docker Desktop / recent WSL installs have it).
|
|
env_file:
|
|
- path: .env
|
|
required: false
|
|
environment:
|
|
- NODE_ENV=production
|
|
- PORT=9876
|
|
- DB_PATH=/app/data/maestro.db
|
|
- WORKTREE_DIR=/workspaces
|
|
volumes:
|
|
# アプリの状態 (DB / users / skills / secrets) を永続化。
|
|
# アプリは WORKDIR /app からの相対 ./data に書くので /app/data にマウントする。
|
|
- maestro-data:/app/data
|
|
# エージェントワークスペース永続化
|
|
- maestro-workspaces:/workspaces
|
|
# config.yaml をホストから永続化したい場合は bind-mount (書き込み可)。
|
|
# Settings UI / npm run setup で書き換えるなら :ro は付けないこと。
|
|
# :ro を付けた新規インストールは、認証設定を書けないため起動を拒否する
|
|
# (#1024)。bind-mount しない場合、コンテナを作り直すと config.yaml は
|
|
# イメージの初期状態に戻る。認証だけは起動時に自動で復旧する。
|
|
# - ./config.yaml:/app/config.yaml
|
|
healthcheck:
|
|
test: ["CMD", "node", "-e", "fetch('http://localhost:9876/health').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 10s
|
|
|
|
volumes:
|
|
maestro-data:
|
|
driver: local
|
|
maestro-workspaces:
|
|
driver: local
|