docker-dev/docker-compose.exp.yml at main · sam-mfb/docker-dev · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
networks:
  exp-internal:
    internal: true
    ipam:
      config:
        - subnet: 172.30.0.0/24
  exp-external:
    driver: bridge

services:
  proxy:
    image: ${PROXY_IMAGE_TAG:-exp-proxy-container}
    container_name: ${PROXY_CONTAINER_NAME:-exp-proxy-container-active}
    hostname: proxy
    networks:
      exp-internal:
        ipv4_address: 172.30.0.2
      exp-external: {}
    extra_hosts:
      - "host.docker.internal:host-gateway"
    cap_add:
      - NET_ADMIN
    healthcheck:
      test: ["CMD-SHELL", "nc -z 127.0.0.1 8888"]
      interval: 2s
      timeout: 3s
      retries: 10
      start_period: 5s
    restart: unless-stopped

  exp:
    image: ${IMAGE_TAG:-sam-exp-container}
    container_name: ${CONTAINER_NAME:-sam-exp-container-active}
    entrypoint: ["bash"]
    shm_size: 2gb
    hostname: ${HOSTNAME:-sam-exp}
    networks:
      exp-internal:
        ipv4_address: 172.30.0.3
    dns:
      - 172.30.0.2
    environment:
      - EXP_CONTAINER=1
      - OAUTH2_FORWARDER_SERVER=proxy:48272
      - OLLAMA_HOST=http://proxy:11434
      - HTTP_PROXY=http://proxy:8888
      - HTTPS_PROXY=http://proxy:8888
      - http_proxy=http://proxy:8888
      - https_proxy=http://proxy:8888
      - NO_PROXY=proxy,172.30.0.2,localhost,127.0.0.1
      - no_proxy=proxy,172.30.0.2,localhost,127.0.0.1
      - ADO_ORG=${ADO_ORG}
    security_opt:
      - seccomp=custom-seccomp.json
    volumes:
      - exp-workspace:/workspace
    depends_on:
      proxy:
        condition: service_healthy
    command:
      - -c
      - |
        # Remove git credential forwarder -- not used in exp container
        sudo git config --system --unset-all credential.helper 2>/dev/null || true
        git config --global --unset-all credential.helper 2>/dev/null || true
        git config --global --unset credential.https://dev.azure.com.useHttpPath 2>/dev/null || true
        # Ensure /workspace is owned by devuser (exp overrides the image
        # entrypoint, so it can't rely on entrypoint.sh's safety chown).
        sudo chown devuser:devuser /workspace 2>/dev/null || true
        exec sleep infinity
    stdin_open: true
    tty: true

volumes:
  # Persistent /workspace for the experimental stack. Separate from the dev
  # stack so the isolated YOLO container can't touch dev work. `name:` pins a
  # stable, unprefixed name matching workspace.sh.
  exp-workspace:
    name: exp-workspace
    labels:
      com.docker-dev.workspace: "exp"