safeagent/docker-compose.yml at main · jamesburchill/safeagent · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
services:
  control-plane:
    build:
      context: ./control-plane
    environment:
      WORKSPACES_ROOT: ${WORKSPACES_ROOT:-/opt/agent-stack/workspaces}
      HOST_WORKSPACES_ROOT: ${HOST_WORKSPACES_ROOT:-${PWD}/workspaces}
      AUDIT_ROOT: ${AUDIT_ROOT:-/opt/agent-stack/audit}
      APPROVALS_ROOT: ${APPROVALS_ROOT:-/opt/agent-stack/approvals}
      APPROVAL_TOKEN: ${APPROVAL_TOKEN:-change-me-approval-token}
      POLICY_PATH: ${POLICY_PATH:-/app/configs/policy.yaml}
      SANDBOX_IMAGE: ${SANDBOX_IMAGE:-agent-safe-sandbox:latest}
      SANDBOX_UID: ${SANDBOX_UID:-10001}
      SANDBOX_GID: ${SANDBOX_GID:-10001}
      SANDBOX_NETWORK_MODEL_ONLY: ${SANDBOX_NETWORK_MODEL_ONLY:-agent_model_only}
      SANDBOX_NETWORK_GIT_READ: ${SANDBOX_NETWORK_GIT_READ:-agent_git_read}
      SANDBOX_NETWORK_PACKAGE_MIRROR: ${SANDBOX_NETWORK_PACKAGE_MIRROR:-agent_package_mirror}
    ports:
      - "${CONTROL_PLANE_PORT:-8080}:8080"
    volumes:
      - ./configs:/app/configs:ro
      - ./scripts:/app/scripts:ro
      - ./workspaces:${WORKSPACES_ROOT:-/opt/agent-stack/workspaces}
      - ./audit:${AUDIT_ROOT:-/opt/agent-stack/audit}
      - ./approvals:${APPROVALS_ROOT:-/opt/agent-stack/approvals}
      - /var/run/docker.sock:/var/run/docker.sock
    restart: unless-stopped

networks:
  default:
    name: agent_stack_default