Repository navigation
Expand file tree
/
Copy pathdocker-compose.yml
More file actions
74 lines (72 loc) · 2.69 KB
/
Copy pathdocker-compose.yml
File metadata and controls
74 lines (72 loc) · 2.69 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
# OpenHuman Core — Docker Compose for self-hosted cloud deploy.
#
# Brings up the headless Rust core (`openhuman-core`) on :7788, persists the
# workspace to a named volume, and reads secrets/config from a `.env` file
# next to this compose file.
#
# Usage:
# 1. cp .env.example .env (then edit values — at minimum BACKEND_URL and
# OPENHUMAN_CORE_TOKEN; the latter is required for any client that calls
# /rpc on this instance)
# 2. docker compose up -d
# 3. curl http://localhost:7788/health
#
# The image is built from the repo Dockerfile. To pin a published image
# instead of building, replace `build:` with `image: ghcr.io/.../openhuman-core:<tag>`.
services:
openhuman-core:
build:
context: .
dockerfile: Dockerfile
image: openhuman-core:local
container_name: openhuman-core
restart: unless-stopped
read_only: true
security_opt:
- no-new-privileges:true
cap_drop:
- ALL
# The entrypoint starts as root so it can repair the ownership of a volume
# Docker created as root:root, then drops to the `openhuman` user. Both
# steps need capabilities that `cap_drop: ALL` removes:
# CHOWN — heal mis-owned workspace files (scripts/docker-entrypoint-core.sh)
# SETUID/SETGID — gosu's privilege drop; without them the container
# crash-loops before openhuman-core ever starts.
# Deny-by-default is preserved: these three are the entire grant.
# Alternative if you prefer zero capabilities: pin `user: "10001:10001"`,
# which makes the entrypoint exec the binary directly and skip the heal —
# at the cost of no longer being able to repair a root-owned volume.
cap_add:
- CHOWN
- SETUID
- SETGID
tmpfs:
- /tmp
ports:
- "${OPENHUMAN_CORE_PORT:-7788}:7788"
env_file:
- path: .env
required: false
environment:
# Bind to 0.0.0.0 inside the container so port-forwarding works regardless
# of what `.env` says. The Dockerfile already sets this default, but make
# it explicit so an inherited shell value cannot override it.
OPENHUMAN_CORE_HOST: 0.0.0.0
OPENHUMAN_CORE_PORT: "7788"
OPENHUMAN_WORKSPACE: /home/openhuman/.openhuman
XDG_CACHE_HOME: /home/openhuman/.openhuman/cache
TMPDIR: /tmp
RUST_LOG: ${RUST_LOG:-info}
volumes:
- openhuman-workspace:/home/openhuman/.openhuman
mem_limit: ${OPENHUMAN_CORE_MEM_LIMIT:-4g}
cpus: ${OPENHUMAN_CORE_CPUS:-2.0}
healthcheck:
test: ["CMD", "curl", "-fsS", "http://localhost:7788/health"]
interval: 30s
timeout: 5s
start_period: 15s
retries: 3
volumes:
openhuman-workspace:
name: openhuman-workspace