docker-compose.yml

# CodeRunner — base compose file (the minimal local/self-hosted deployment).
#
#   docker compose up -d        → control plane on http://localhost:4000
#   CODERUNNER_DEMO_MODE=1 docker compose up -d
#                                → demo mode (auth bypassed, shared workspace)
#
# Overrides:
#   docker-compose.prod.yml     adds Caddy (TLS) + Grafana Alloy for the
#                               production VM; selected there via COMPOSE_FILE
#                               in /opt/coderunner/.env
#
# Configuration lives in .env (see .env.example). The control plane drives the
# HOST's Docker daemon through the bind-mounted socket, so per-student
# workspace containers run as siblings of this one, joined to the shared
# `coderunner` network below. It inspects its own container at startup to
# auto-detect the workspace network, the host-side data path, and the uid:gid
# that owns the data dir, so those need no env plumbing here (the matching
# FRC_* env vars remain optional overrides).

name: coderunner

services:
  control:
    # Pin the container name (drops compose's `-1` replica suffix) so it reads
    # as `coderunner-control` in Portainer / `docker ps`. Does not change the
    # hostname, so the control plane's self-inspection (docker inspect
    # $HOSTNAME) is unaffected; the service name still resolves on the network
    # for Caddy.
    container_name: coderunner-control
    image: ${CODERUNNER_IMAGE_NS:-ghcr.io/mathewdunne}/coderunner-control:${CODERUNNER_TAG:-latest}
    restart: unless-stopped
    # Run as the host owner of the data dir (keeps ./data host-owned, drops
    # root). group_add grants the non-root process access to the bind-mounted
    # Docker socket. The numeric socket gid works even without a matching named
    # group inside the container, and the same identity applies to
    # `docker compose run --rm control <subcommand>`, so ops commands run
    # non-root too.
    #
    # The socket's owner differs by platform: root inside Docker Desktop's VM
    # on macOS and native Windows (hence the 0 default, which makes those
    # zero-config), a `docker` group on Linux and WSL2 (WSL2 integration
    # included), where you must set
    # CODERUNNER_DOCKER_GID — find it with `stat -c '%g' /var/run/docker.sock`
    # (prod writes it into .env from cloud-init). Supplementary groups do not
    # affect the ownership of files the process creates, so ./data stays
    # host-owned either way.
    user: "${CODERUNNER_UID:-1000}:${CODERUNNER_GID:-1000}"
    group_add:
      - "${CODERUNNER_DOCKER_GID:-0}"
    # The control plane needs host Docker socket and data access on SELinux
    # hosts. Exempt only this trusted orchestrator; student containers retain
    # SELinux confinement and relabel their own bind mounts for shared access.
    security_opt:
      - label=disable
    ports:
      # Loopback only: Caddy (prod) or the local browser reaches it here.
      - "127.0.0.1:4000:4000"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      # Compose resolves ./ against the project directory. Set
      # CODERUNNER_HOST_DATA_DIR to relocate the data dir (e.g. a mounted disk).
      # Do not relabel the whole tree: it includes student container mounts.
      - ${CODERUNNER_HOST_DATA_DIR:-./data}:/data
    environment:
      CODE_IMAGE: ${CODERUNNER_IMAGE_NS:-ghcr.io/mathewdunne}/coderunner-workspace:${CODERUNNER_TAG:-latest}
      # Demo mode: auth bypassed, everyone shares one admin workspace. Unset
      # (or any falsy value) keeps normal auth. Never expose a demo instance
      # publicly.
      CODERUNNER_DEMO_MODE: ${CODERUNNER_DEMO_MODE:-}
    env_file:
      - path: .env
        required: false
    networks:
      - coderunner
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:4000/healthz"]
      interval: 15s
      timeout: 3s
      retries: 5
      start_period: 20s

  # Pull-only helper: the workspace image is started by the control plane via
  # the Docker CLI, not by compose, so this stub makes `docker compose pull`
  # and the first `up` fetch it. It exits immediately and stays stopped. Named
  # `workspace-template` because it represents the per-student template image,
  # not a running service.
  workspace-template:
    container_name: coderunner-workspace-template
    image: ${CODERUNNER_IMAGE_NS:-ghcr.io/mathewdunne}/coderunner-workspace:${CODERUNNER_TAG:-latest}
    entrypoint: ["/bin/true"]
    restart: "no"
    network_mode: "none"

networks:
  coderunner:
    # Explicit (non-project-prefixed) name so the control plane can pass it
    # verbatim to `docker run --network`. Self-inspection reads it back from
    # this container's own network attachment at startup.
    name: coderunner
    driver: bridge