70 lines
1.8 KiB
YAML
70 lines
1.8 KiB
YAML
services:
|
|
agent:
|
|
build:
|
|
context: .
|
|
target: agent
|
|
init: true
|
|
user: "1000:1000"
|
|
read_only: true
|
|
cap_drop: [ALL]
|
|
security_opt: ["no-new-privileges:true"]
|
|
pids_limit: 128
|
|
cpus: 2.0
|
|
mem_limit: 4g
|
|
memswap_limit: 4g
|
|
restart: "no"
|
|
stop_grace_period: 15s
|
|
ports: ["127.0.0.1:${SANDBOX_PORT:-15173}:5173"]
|
|
networks: [isolated]
|
|
volumes:
|
|
- sandbox-data:/app/workspace
|
|
tmpfs:
|
|
- /tmp:rw,noexec,nosuid,size=256m,mode=1777
|
|
- /home/node:rw,noexec,nosuid,size=32m,uid=1000,gid=1000
|
|
environment:
|
|
NODE_USE_ENV_PROXY: "1"
|
|
HTTPS_PROXY: http://egress:3128
|
|
HTTP_PROXY: http://egress:3128
|
|
NO_PROXY: localhost,127.0.0.1
|
|
SANDBOX_MODE: docker
|
|
SANDBOX_TTL_SECONDS: "3600"
|
|
AGENT_SKILLS_DIRS: ""
|
|
ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
|
|
OPENAI_API_KEY: ${OPENAI_API_KEY:-}
|
|
SWADS_MCP_TOKEN: ${SWADS_MCP_TOKEN:-}
|
|
SWADS_MCP_URL: ${SWADS_MCP_URL:-https://ads.mincode.cn/mcp}
|
|
depends_on: [egress]
|
|
healthcheck:
|
|
test: [CMD, node, -e, "fetch('http://127.0.0.1:3001/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
|
|
interval: 10s
|
|
timeout: 3s
|
|
retries: 6
|
|
logging:
|
|
driver: json-file
|
|
options: {max-size: 10m, max-file: "3"}
|
|
egress:
|
|
build:
|
|
context: .
|
|
target: egress
|
|
user: "1000:1000"
|
|
read_only: true
|
|
cap_drop: [ALL]
|
|
security_opt: ["no-new-privileges:true"]
|
|
pids_limit: 32
|
|
cpus: 0.5
|
|
mem_limit: 128m
|
|
memswap_limit: 128m
|
|
restart: "no"
|
|
networks: [isolated, outbound]
|
|
environment:
|
|
EGRESS_HOSTS: ${SANDBOX_EGRESS_HOSTS:-gateway.pencil-stub.com,ads.mincode.cn}
|
|
logging:
|
|
driver: json-file
|
|
options: {max-size: 5m, max-file: "2"}
|
|
networks:
|
|
isolated:
|
|
internal: true
|
|
outbound: {}
|
|
volumes:
|
|
sandbox-data: {}
|