docker-compose.yml

# =============================================================================
# Pythinker — Development Compose (Docker Compose Watch)
#
# Usage:
#   ./dev.sh                    Build + start + live file watch (DEFAULT)
#   ./dev.sh watch              Same as above (explicit)
#   ./dev.sh attach             Attach watch to already-running containers
#   ./dev.sh up -d              Start without watch
#   ./dev.sh logs -f backend    Follow logs
#   ./dev.sh down -v            Stop + remove volumes
#   ./dev.sh --monitoring watch Include Prometheus/Grafana/Loki stack
#
# Compose Watch syncs file changes from host -> container via Docker API
# (tar+cp). Files land on the container's native ext4 filesystem, so inotify
# fires immediately — no polling required.
# =============================================================================

services:
  # ---------------------------------------------------------------------------
  # Frontend (Vite dev server with HMR)
  # ---------------------------------------------------------------------------
  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile.dev
    ports:
      - "5174:5174"
    environment:
      - NODE_ENV=development
      - VITE_API_URL=
      - BACKEND_URL=http://backend:8000
      - VITE_HOST=true
    depends_on:
      backend:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - pythinker-network
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:5174/ >/dev/null || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    develop:
      watch:
        - action: sync
          path: ./frontend/src
          target: /app/src
        - action: sync
          path: ./frontend/public
          target: /app/public
        - action: sync
          path: ./frontend/index.html
          target: /app/index.html
        - action: sync
          path: ./frontend/vite.config.ts
          target: /app/vite.config.ts
        - action: sync
          path: ./frontend/tsconfig.json
          target: /app/tsconfig.json
        - action: sync
          path: ./frontend/tsconfig.app.json
          target: /app/tsconfig.app.json
        - action: sync
          path: ./frontend/tsconfig.node.json
          target: /app/tsconfig.node.json
        - action: sync
          path: ./frontend/env.d.ts
          target: /app/env.d.ts
        - action: sync
          path: ./frontend/eslint.config.js
          target: /app/eslint.config.js
        - action: rebuild
          path: ./frontend/package.json
        - action: rebuild
          path: ./frontend/package-lock.json
        - action: rebuild
          path: ./frontend/bun.lock

  # ---------------------------------------------------------------------------
  # Backend (FastAPI + uvicorn --reload)
  # ---------------------------------------------------------------------------
  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
    command: ["./dev.sh"]
    # 15s grace period gives SSE streams time to drain during dev reloads
    # (default 10s is too short for long-lived research sessions).
    stop_grace_period: 15s
    # Docker socket: Linux is usually root:docker (set DOCKER_GID from host:
    # getent group docker | cut -d: -f3). OrbStack / Docker Desktop often expose it as
    # root:root (660); supplementary group 0 lets appuser use the socket without root.
    group_add:
      - "${DOCKER_GID:-988}"
      - "0"
    volumes:
      # Must be read-write: the API client writes HTTP to the Unix socket; :ro can cause EACCES.
      - /var/run/docker.sock:/var/run/docker.sock
      - dspy_cache:/app/data/dspy_cache
    ports:
      - "8000:8000"
    depends_on:
      mongodb:
        condition: service_healthy
      redis:
        condition: service_healthy
      qdrant:
        condition: service_healthy
      minio:
        condition: service_healthy
      sandbox:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - pythinker-network
    env_file:
      - .env
    environment:
      - SANDBOX_LIFECYCLE_MODE=static
      - SANDBOX_ADDRESS=sandbox
      - SANDBOX_IMAGE=pythinker/pythinker-sandbox
      - MONGODB_URI=${MONGODB_URI:-mongodb://mongodb:27017/pythinker?authSource=admin}
      - MONGODB_USERNAME=${MONGODB_USERNAME:-pythinker_admin}
      - MONGODB_PASSWORD=${MONGODB_PASSWORD:-pythinker_admin_password_change_me}
      - SANDBOX_CHROME_ARGS=--no-sandbox --disable-setuid-sandbox --disable-crashpad --user-data-dir=/tmp/chrome --no-zygote --js-flags=--max-old-space-size=768
      - SANDBOX_API_SECRET=${SANDBOX_API_SECRET:-dev-sandbox-secret-change-me}
      - LOCAL_AUTH_PASSWORD=${LOCAL_AUTH_PASSWORD:-changeme}
      - GRPC_ENABLE_FORK_SUPPORT=0
      - NODE_OPTIONS=--no-deprecation
      - BACKEND_ENABLE_RELOAD=${BACKEND_ENABLE_RELOAD:-1}
      - BACKEND_UVICORN_GRACEFUL_TIMEOUT=${BACKEND_UVICORN_GRACEFUL_TIMEOUT:-120}
      - SANDBOX_CALLBACK_TOKEN=${SANDBOX_CALLBACK_TOKEN:-}
      - LOG_FORMAT=${LOG_FORMAT:-json}
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://localhost:8000/api/v1/health >/dev/null || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 15s
    develop:
      watch:
        - action: sync
          path: ./backend/app
          target: /app/app
          ignore:
            - "**/__pycache__"
            - "**/*.pyc"
        - action: rebuild
          path: ./backend/requirements.txt

  # ---------------------------------------------------------------------------
  # Gateway (Telegram / channel integration) — opt-in via: --profile channels
  # ---------------------------------------------------------------------------
  gateway:
    profiles: ["channels"]
    build:
      context: ./backend
      dockerfile: Dockerfile.gateway
    command: ["python", "-m", "app.interfaces.gateway.gateway_runner"]
    group_add:
      - "${DOCKER_GID:-988}"
      - "0"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - dspy_cache:/app/data/dspy_cache
    depends_on:
      backend:
        condition: service_healthy
      mongodb:
        condition: service_healthy
      redis:
        condition: service_healthy
      qdrant:
        condition: service_healthy
      minio:
        condition: service_healthy
      sandbox:
        condition: service_healthy
    restart: unless-stopped
    networks:
      - pythinker-network
    env_file:
      - .env
    environment:
      - CHANNEL_GATEWAY_ENABLED=true
      - SANDBOX_LIFECYCLE_MODE=static
      - SANDBOX_ADDRESS=sandbox
      - SANDBOX_IMAGE=pythinker/pythinker-sandbox
      - MONGODB_URI=${MONGODB_URI:-mongodb://mongodb:27017/pythinker?authSource=admin}
      - MONGODB_USERNAME=${MONGODB_USERNAME:-pythinker_admin}
      - MONGODB_PASSWORD=${MONGODB_PASSWORD:-pythinker_admin_password_change_me}
      - SANDBOX_CHROME_ARGS=--no-sandbox --disable-setuid-sandbox --disable-crashpad --user-data-dir=/tmp/chrome --no-zygote --js-flags=--max-old-space-size=768
      - SANDBOX_API_SECRET=${SANDBOX_API_SECRET:-dev-sandbox-secret-change-me}
      - LOCAL_AUTH_PASSWORD=${LOCAL_AUTH_PASSWORD:-changeme}
      - GRPC_ENABLE_FORK_SUPPORT=0
      - NODE_OPTIONS=--no-deprecation
      - FAST_MODEL=${FAST_MODEL:-}
      - LOG_FORMAT=${LOG_FORMAT:-json}
    develop:
      watch:
        - action: sync+restart
          path: ./backend/app
          target: /app/app
          ignore:
            - "**/__pycache__"
            - "**/*.pyc"
        - action: rebuild
          path: ./backend/requirements.txt

  # ---------------------------------------------------------------------------
  # Sandbox (Isolated Docker execution environment)
  # ---------------------------------------------------------------------------
  sandbox:
    build:
      context: ./sandbox
      dockerfile: Dockerfile
      args:
        ENABLE_SANDBOX_ADDONS: "${ENABLE_SANDBOX_ADDONS:-0}"
    hostname: sandbox
    read_only: true
    security_opt:
      - no-new-privileges:true
      - seccomp=./sandbox/seccomp-sandbox.hardened.json
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETUID
      - SETGID
    volumes:
      - /app/__pycache__
      - /app/.venv
      - /opt/base-python-venv
    ports:
      - "127.0.0.1:8083:8080"
      - "127.0.0.1:8082:8082"
      - "127.0.0.1:8443:8443"
    shm_size: '${SANDBOX_SHM_SIZE:-1g}'
    tmpfs:
      - /run:size=50M,nosuid,nodev,uid=1000,gid=1000
      - /run/user/1000:size=10M,nosuid,nodev,uid=1000,gid=1000,mode=0700
      - /tmp:size=1G,nosuid,nodev
      - /home/ubuntu:size=2G,nosuid,nodev,uid=1000,gid=1000
      - /var:size=500M,nosuid,nodev
      - /workspace:size=2G,nosuid,nodev,uid=1000,gid=1000
    ulimits:
      nofile:
        soft: 65536
        hard: 65536
      nproc:
        soft: 4096
        hard: 8192
    deploy:
      resources:
        limits:
          memory: ${SANDBOX_MEM_LIMIT:-4G}
          cpus: '${SANDBOX_CPU_LIMIT:-1.5}'
          pids: 4096
        reservations:
          memory: ${SANDBOX_MEM_RESERVATION:-512M}
    environment:
      - SANDBOX_STREAMING_MODE=${SANDBOX_STREAMING_MODE:-cdp_only}
      - ENABLE_VNC=${ENABLE_VNC:-1}
      - SANDBOX_API_SECRET=${SANDBOX_API_SECRET:-dev-sandbox-secret-change-me}
      - SUPERVISOR_RPC_USERNAME=${SUPERVISOR_RPC_USERNAME:-supervisor}
      - SUPERVISOR_RPC_PASSWORD=${SUPERVISOR_RPC_PASSWORD:-supervisor-dev-password}
      - UVI_ARGS=--reload --reload-delay 10.0 --reload-dir /app/app
      - FRAMEWORK_UVI_ARGS=--reload --reload-delay 10.0 --reload-dir /app/app
      - WATCHFILES_FORCE_POLLING=false
      - FRAMEWORK_DATABASE_URL=sqlite+aiosqlite:////home/ubuntu/.local/pythinker_sandbox.db
      - LOG_LEVEL=${LOG_LEVEL:-DEBUG}
      # --ignore-certificate-errors: dev sandbox only; avoids TLS handshake failures on some sites (Chromium net_error -178).
      - CHROME_ARGS=--no-sandbox --disable-setuid-sandbox --disable-crashpad --user-data-dir=/tmp/chrome --no-zygote --renderer-process-limit=1 --disable-gpu --disable-dev-shm-usage --disable-background-networking --disable-sync --disable-translate --disable-default-apps --no-first-run --disable-extensions --disable-component-extensions-with-background-pages --disable-features=CalculateNativeWinOcclusion,TranslateUI,BlinkGenPropertyTrees,IsolateOrigins,site-per-process --disable-gpu-memory-buffer-compositor-resources --disable-gpu-memory-buffer-video-frames --disable-breakpad --disable-domain-reliability --disable-hang-monitor --metrics-recording-only --mute-audio --js-flags=--max-old-space-size=512 --disable-smooth-scrolling --disable-composited-antialiasing --disable-checker-imaging --ignore-certificate-errors
      - BROWSER_PATH=/usr/local/bin/chromium
      - LIBGL_ALWAYS_SOFTWARE=1
      - TZ=${TZ:-UTC}
      - SANDBOX_VERSION=${IMAGE_TAG:-dev}
      - SHELL_USE_STRUCTURED_MARKERS=${SHELL_USE_STRUCTURED_MARKERS:-true}
      - RUNTIME_API_HOST=${RUNTIME_API_HOST:-http://backend:8000}
      - RUNTIME_API_TOKEN=${SANDBOX_CALLBACK_TOKEN:-}
      - OPENAI_API_BASE=${SANDBOX_LLM_PROXY_URL:-http://backend:8000/api/v1/llm-proxy/v1}
      - OPENAI_BASE_URL=${SANDBOX_LLM_PROXY_URL:-http://backend:8000/api/v1/llm-proxy/v1}
      - OPENAI_API_KEY=${SANDBOX_LLM_PROXY_KEY:-}
      - CODE_SERVER_PORT=${CODE_SERVER_PORT:-8443}
      - CODE_SERVER_PASSWORD=${CODE_SERVER_PASSWORD:-disabled}
      - ENABLE_CODE_SERVER=${ENABLE_CODE_SERVER:-0}
      - OTEL_ENABLED=${OTEL_ENABLED:-false}
      - PLOTLY_RUNTIME_AVAILABLE=${PLOTLY_RUNTIME_AVAILABLE:-0}
      - OTEL_EXPORTER_OTLP_ENDPOINT=${OTEL_EXPORTER_OTLP_ENDPOINT:-}
      - OTEL_SERVICE_NAME=sandbox-runtime
      - OTEL_TRACES_SAMPLER_RATIO=${OTEL_TRACES_SAMPLER_RATIO:-1.0}
      - SENTRY_DSN=${SANDBOX_SENTRY_DSN:-}
      - GH_TOKEN=${GH_TOKEN:-}
      - GOOGLE_DRIVE_TOKEN=${GOOGLE_DRIVE_TOKEN:-}
      - GOOGLE_WORKSPACE_CLI_TOKEN=${GOOGLE_WORKSPACE_CLI_TOKEN:-}
    restart: unless-stopped
    networks:
      - pythinker-network
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      start_period: 60s
      retries: 3
    develop:
      watch:
        - action: sync
          path: ./sandbox/app
          target: /app/app
          ignore:
            - "**/__pycache__"
            - "**/*.pyc"
        - action: sync
          path: ./sandbox/scripts
          target: /app/scripts
        - action: sync+restart
          path: ./sandbox/scripts/run_x11vnc.sh
          target: /app/scripts/run_x11vnc.sh
        - action: sync+restart
          path: ./sandbox/supervisord.conf
          target: /app/supervisord.conf
        - action: rebuild
          path: ./sandbox/requirements.txt
        - action: rebuild
          path: ./sandbox/requirements.runtime.txt

  # ---------------------------------------------------------------------------
  # MongoDB
  # ---------------------------------------------------------------------------
  mongodb:
    image: mongo:7.0.31
    command: ["mongod", "--wiredTigerCacheSizeGB", "0.25"]
    environment:
      - MONGO_INITDB_ROOT_USERNAME=${MONGODB_USERNAME:-pythinker_admin}
      - MONGO_INITDB_ROOT_PASSWORD=${MONGODB_PASSWORD:-pythinker_admin_password_change_me}
    mem_limit: 512m
    ulimits:
      nofile:
        soft: 64000
        hard: 64000
    volumes:
      - mongodb_data:/data/db
    restart: unless-stopped
    ports:
      - "127.0.0.1:27017:27017"
    networks:
      - pythinker-network
    healthcheck:
      test: ["CMD-SHELL", "mongosh --norc --quiet -u \"$$MONGO_INITDB_ROOT_USERNAME\" -p \"$$MONGO_INITDB_ROOT_PASSWORD\" --authenticationDatabase admin --eval \"db.runCommand({ping:1}).ok\" || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 20s

  # ---------------------------------------------------------------------------
  # Redis
  # ---------------------------------------------------------------------------
  redis:
    image: redis:8.4-alpine
    mem_limit: 512m
    command:
      - redis-server
      - --save
      - ""
      - --appendonly
      - "yes"
      - --appendfsync
      - everysec
      - --aof-use-rdb-preamble
      - "yes"
      - --loglevel
      - warning
      - --timeout
      - "0"
      - --maxmemory
      - ${REDIS_MAXMEMORY:-512mb}
      - --maxmemory-policy
      - ${REDIS_MAXMEMORY_POLICY:-volatile-lfu}
      - --lazyfree-lazy-eviction
      - "yes"
      - --latency-monitor-threshold
      - "100"
    volumes:
      - redis_runtime_data:/data
    restart: unless-stopped
    networks:
      - pythinker-network
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 5s

  # ---------------------------------------------------------------------------
  # MinIO (S3-compatible object storage)
  # ---------------------------------------------------------------------------
  minio:
    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
    command: server /data --console-address ":9001"
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '1'
        reservations:
          memory: 128M
    environment:
      - MINIO_ROOT_USER=${MINIO_ROOT_USER:-minio-dev-admin}
      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD:-minio-dev-password-change-me}
      - MINIO_IDENTITY_OPENID_ENABLE=off
    volumes:
      - minio_data:/data
    ports:
      - "127.0.0.1:9010:9000"
      - "127.0.0.1:9011:9001"
    restart: unless-stopped
    networks:
      - pythinker-network
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

  # ---------------------------------------------------------------------------
  # MinIO Init (create service user)
  # ---------------------------------------------------------------------------
  minio-init:
    image: minio/mc:RELEASE.2025-08-13T08-35-41Z
    depends_on:
      minio:
        condition: service_healthy
    environment:
      - MINIO_ROOT_USER=${MINIO_ROOT_USER:-minio-dev-admin}
      - MINIO_ROOT_PASSWORD=${MINIO_ROOT_PASSWORD:-minio-dev-password-change-me}
      - MINIO_SERVICE_USER=${MINIO_SERVICE_USER:-pythinker-svc}
      - MINIO_SERVICE_PASSWORD=${MINIO_SERVICE_PASSWORD:-pythinker-svc-secret-change-me}
    entrypoint: /bin/sh
    command:
      - -c
      - |
        sleep 3 && \
        mc alias set myminio http://minio:9000 "$${MINIO_ROOT_USER}" "$${MINIO_ROOT_PASSWORD}" && \
        mc mb myminio/pythinker --ignore-existing && \
        mc mb myminio/screenshots --ignore-existing && \
        mc mb myminio/thumbnails --ignore-existing && \
        mc mb myminio/sandbox-snapshots --ignore-existing && \
        echo "Buckets ready: pythinker, screenshots, thumbnails, sandbox-snapshots" && \
        mc admin user add myminio "$${MINIO_SERVICE_USER}" "$${MINIO_SERVICE_PASSWORD}" 2>/dev/null || true && \
        mc admin policy attach myminio readwrite --user "$${MINIO_SERVICE_USER}" 2>/dev/null || true && \
        echo "MinIO service user '$$MINIO_SERVICE_USER' ready with readwrite policy"
    networks:
      - pythinker-network
    restart: "no"

  # ---------------------------------------------------------------------------
  # Qdrant (Vector database)
  # ---------------------------------------------------------------------------
  qdrant:
    image: qdrant/qdrant:v1.17.0
    container_name: pythinker-qdrant
    mem_limit: 2g
    ports:
      - "127.0.0.1:6333:6333"
      - "127.0.0.1:6334:6334"
    volumes:
      - qdrant_data:/qdrant/storage
    environment:
      - QDRANT__SERVICE__GRPC_PORT=6334
    restart: unless-stopped
    networks:
      - pythinker-network
    healthcheck:
      test: ["CMD-SHELL", "bash -c 'echo > /dev/tcp/localhost/6333' || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s

volumes:
  mongodb_data:
    name: pythinker-mongodb-data
  redis_runtime_data:
    name: pythinker-redis-runtime-data
  qdrant_data:
    name: pythinker-qdrant-data
  minio_data:
    name: pythinker-minio-data
  dspy_cache:
    name: pythinker-dspy-cache

networks:
  pythinker-network:
    name: pythinker-network
    driver: bridge