forked from admin/VolcanicAgenticCore
7bb41f0b5b
Entrypoint drops the capability bounding set and sets no_new_privs. Security docs and spec no longer claim the agent can't reach the secrets; docker exec fallbacks use a clean environment. PLAYWRIGHT_ENABLED drops the nested compose default. Tests pin the Dockerfile's Playwright install step and the compose model fallback.
44 lines
2.0 KiB
YAML
44 lines
2.0 KiB
YAML
services:
|
|
bot:
|
|
build:
|
|
context: .
|
|
args:
|
|
INSTALL_PLAYWRIGHT: ${INSTALL_PLAYWRIGHT:-true}
|
|
CLAUDE_CODE_VERSION: ${CLAUDE_CODE_VERSION:-2.1}
|
|
restart: unless-stopped
|
|
# dotnet does not reap orphans; killed `claude` trees and bash tool children would pile up as zombies.
|
|
# docker-init runs as root (the image user), so the agent can't read its /proc/1/environ.
|
|
init: true
|
|
# Chromium crashes with Docker's 64 MB /dev/shm.
|
|
shm_size: 1gb
|
|
stop_grace_period: 30s
|
|
environment:
|
|
- TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN}
|
|
- TELEGRAM_ALLOWED_USER_IDS=${TELEGRAM_ALLOWED_USER_IDS}
|
|
- Telegram__Model=${TELEGRAM_MODEL:-claude-code/claude-opus-5-5}
|
|
- TZ=${TZ:-UTC}
|
|
- Logging__LogLevel__Default=${LOG_LEVEL:-Information}
|
|
# Optional features; empty means off / default.
|
|
- OPENAI_API_KEY=${OPENAI_API_KEY:-} # speech to text (attachments spec)
|
|
- STT_MODEL=${STT_MODEL:-}
|
|
- GOOGLE_CLIENT_ID=${GOOGLE_CLIENT_ID:-} # Google Calendar (calendar spec)
|
|
- GOOGLE_CLIENT_SECRET=${GOOGLE_CLIENT_SECRET:-}
|
|
- DEFAULT_TIMEZONE=${DEFAULT_TIMEZONE:-} # chats' default zone (scheduler spec §7); empty → TZ
|
|
- PROCESS_ENV_ALLOW=${PROCESS_ENV_ALLOW:-} # deny-listed variables the agent may see, e.g. GH_TOKEN
|
|
# Playwright MCP preset (MCP spec): the preinstalled binary, no npx download. Set PLAYWRIGHT_ENABLED=false for an
|
|
# image built with INSTALL_PLAYWRIGHT=false (no nested default: Coolify parses these expressions itself).
|
|
- PLAYWRIGHT_ENABLED=${PLAYWRIGHT_ENABLED:-true}
|
|
- PLAYWRIGHT_HEADLESS=${PLAYWRIGHT_HEADLESS:-true} # no display in the container
|
|
- PLAYWRIGHT_BROWSER=${PLAYWRIGHT_BROWSER:-}
|
|
- PLAYWRIGHT_EXTRA_ARGS=${PLAYWRIGHT_EXTRA_ARGS:---no-sandbox}
|
|
- PLAYWRIGHT_COMMAND=${PLAYWRIGHT_COMMAND:-playwright-mcp}
|
|
volumes:
|
|
- workspaces:/data/workspaces
|
|
- agent:/data/agent
|
|
- claude:/data/claude
|
|
|
|
volumes:
|
|
workspaces:
|
|
agent:
|
|
claude:
|