docker-compose.socket-proxy.yml

# Socket-isolated deployment: Libre WebUI never sees the Docker socket.
#
# A socket proxy holds /var/run/docker.sock and forwards only the API
# sections Work needs (containers, images, volumes, networks, exec, info).
# Everything else — swarm, secrets, configs, plugins, system/session, build,
# commit — is denied at the proxy. This narrows the API surface, but it is not
# a host-security boundary: container creation can request bind mounts or
# privileged settings and therefore remains root-equivalent Docker-host
# control. The proxy lives on an internal network that only the app can reach;
# it publishes no host ports.
#
#   docker compose -f docker-compose.socket-proxy.yml up -d
services:
  libre-webui:
    image: librewebui/libre-webui:latest
    ports:
      - '${WEBUI_BIND_ADDRESS:-127.0.0.1}:${WEBUI_PORT:-8080}:3001'
    extra_hosts:
      - 'host.docker.internal:host-gateway'
    environment:
      - NODE_ENV=production
      - DOCKER_ENV=true
      # Docker Desktop reaches host-loopback Work ports through this name.
      # Native Linux should override WORK_PREVIEW_BIND with its Docker bridge gateway.
      - WORK_PREVIEW_BIND=${WORK_PREVIEW_BIND:-127.0.0.1}
      - WORK_DOCKER_PUBLISHED_HOST=${WORK_DOCKER_PUBLISHED_HOST:-host.docker.internal}
      - PORT=3001
      - OLLAMA_BASE_URL=http://ollama:11434
      # Work talks to the Docker Engine API through the filtered proxy.
      # The docker CLI, the interactive terminal, and system diagnostics all
      # follow this endpoint; no socket mount or socket-group membership.
      - DOCKER_HOST=tcp://docker-socket-proxy:2375
      # For network access, add your IP/hostname to CORS_ORIGIN:
      - CORS_ORIGIN=http://localhost:8080
      - ENABLE_SIGNUP=${ENABLE_SIGNUP:-false}
      # JWT_SECRET: Generate with 'openssl rand -hex 64' and set via .env file or environment
      - JWT_SECRET=${JWT_SECRET:-}
      - JWT_EXPIRES_IN=7d
      # Encryption: Optional 64-character hex key. If not provided, one will be auto-generated
      # and stored in the persistent data volume for security across container restarts
      - ENCRYPTION_KEY=${ENCRYPTION_KEY:-}
      # Platform foundation selectors. Shared backends remain fail-closed;
      # Redis coordination is usable in solo mode with an external REDIS_URL.
      - LIBRE_PLATFORM_MODE=${LIBRE_PLATFORM_MODE:-solo}
      - DATABASE_BACKEND=${DATABASE_BACKEND:-sqlite}
      - DATABASE_URL=${DATABASE_URL:-}
      - BLOB_STORE_BACKEND=${BLOB_STORE_BACKEND:-local}
      - VECTOR_STORE_BACKEND=${VECTOR_STORE_BACKEND:-embedded}
      - COORDINATION_BACKEND=${COORDINATION_BACKEND:-local}
      - REDIS_URL=${REDIS_URL:-}
      - REDIS_KEY_PREFIX=${REDIS_KEY_PREFIX:-libre}
      - REDIS_CONNECT_TIMEOUT_MS=${REDIS_CONNECT_TIMEOUT_MS:-5000}
      - JOB_WORKER_MODE=${JOB_WORKER_MODE:-embedded}
      - STORAGE_ENCRYPTION_KEYS=${STORAGE_ENCRYPTION_KEYS:-}
      - STORAGE_ENCRYPTION_ACTIVE_KEY_ID=${STORAGE_ENCRYPTION_ACTIVE_KEY_ID:-}
      # Timeout configuration for large models on multiple GPUs
      - OLLAMA_TIMEOUT=${OLLAMA_TIMEOUT:-300000}
      - OLLAMA_LONG_OPERATION_TIMEOUT=${OLLAMA_LONG_OPERATION_TIMEOUT:-900000}
      - VITE_API_TIMEOUT=${VITE_API_TIMEOUT:-300000}
      # Database path - points to the volume mount
      - DATA_DIR=/app/backend/data
      - PLATFORM_PREFLIGHT_TMP_DIR=/app/backend/temp/preflight
      # GitHub OAuth2 SSO Configuration
      - GITHUB_CLIENT_ID=${GITHUB_CLIENT_ID:-}
      - GITHUB_CLIENT_SECRET=${GITHUB_CLIENT_SECRET:-}
      - GITHUB_CALLBACK_URL=${GITHUB_CALLBACK_URL:-http://localhost:8080/api/auth/oauth/github/callback}
      # Hugging Face OAuth2 SSO Configuration
      - HUGGINGFACE_CLIENT_ID=${HUGGINGFACE_CLIENT_ID:-}
      - HUGGINGFACE_CLIENT_SECRET=${HUGGINGFACE_CLIENT_SECRET:-}
      - HUGGINGFACE_CALLBACK_URL=${HUGGINGFACE_CALLBACK_URL:-http://localhost:8080/api/auth/oauth/huggingface/callback}
      - SESSION_SECRET=${SESSION_SECRET:-}
    volumes:
      - libre_webui_data:/app/backend/data
      - libre_webui_temp:/app/backend/temp
    depends_on:
      - ollama
      - docker-socket-proxy
    restart: unless-stopped
    networks:
      - libre-webui-network
      - docker-proxy

  docker-socket-proxy:
    image: tecnativa/docker-socket-proxy:v0.4.2
    environment:
      # Exactly the surface Work uses. GET /_ping and /version are allowed
      # by the proxy's defaults; POST=1 gates every write (create, start,
      # stop, remove) behind the sections enabled here.
      - CONTAINERS=1
      - IMAGES=1
      - VOLUMES=1
      - NETWORKS=1
      - EXEC=1
      - INFO=1
      - PING=1
      - VERSION=1
      - POST=1
      # The proxy image defaults EVENTS to enabled; Work does not use it.
      - EVENTS=0
      # Never enabled: SWARM, SECRETS, CONFIGS, SERVICES, TASKS, NODES,
      # PLUGINS, BUILD, COMMIT, SESSION, SYSTEM, DISTRIBUTION.
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    restart: unless-stopped
    networks:
      - docker-proxy

  ollama:
    image: ollama/ollama:latest
    volumes:
      - ollama_data:/root/.ollama
    restart: unless-stopped
    networks:
      - libre-webui-network
    # Uncomment the following lines if you have GPU support
    # deploy:
    #   resources:
    #     reservations:
    #       devices:
    #         - driver: nvidia
    #           count: 1
    #           capabilities: [gpu]

volumes:
  libre_webui_data:
  libre_webui_temp:
  ollama_data:

networks:
  libre-webui-network:
    driver: bridge
  # Internal: the proxy is reachable only from containers on this network,
  # never from the host or the outside world.
  docker-proxy:
    driver: bridge
    internal: true