wehub-resource-sync
83 lines
3.1 KiB
YAML
83 lines
3.1 KiB
YAML
services:
|
|
vibe-trading:
|
|
build: .
|
|
ports:
|
|
- "127.0.0.1:8899:8899"
|
|
env_file:
|
|
- agent/.env
|
|
environment:
|
|
- VIBE_TRADING_TRUST_DOCKER_LOOPBACK=1
|
|
# Ollama runs on the host; from inside the container "localhost" is the
|
|
# container itself, so default to reaching the host via host.docker.internal.
|
|
# Override by exporting OLLAMA_BASE_URL (or setting it in a top-level .env)
|
|
# when Ollama runs elsewhere or on a different port.
|
|
- OLLAMA_BASE_URL=${OLLAMA_BASE_URL:-http://host.docker.internal:11434}
|
|
extra_hosts:
|
|
# Maps host.docker.internal -> host gateway (needed on Linux; harmless on Docker Desktop).
|
|
# Requires Docker Engine >= 20.10 / Compose v2 (host-gateway support).
|
|
- "host.docker.internal:host-gateway"
|
|
volumes:
|
|
- vibe-runs:/app/agent/runs
|
|
- vibe-sessions:/app/agent/sessions
|
|
# User-level agent state: persistent memory, cross-session search index
|
|
# (sessions.db), user-created skills, shadow accounts, hypothesis
|
|
# registry, broker connector config, agent.json. Without this volume a
|
|
# rebuild/recreate wipes it all (#197).
|
|
- vibe-home:/home/vibe/.vibe-trading
|
|
- vibe-swarm-runs:/app/agent/.swarm/runs
|
|
- vibe-uploads:/app/agent/uploads
|
|
# Persist Web-UI-driven agent/.env edits (_write_env_values in
|
|
# src/api/helpers.py writes to /app/agent/.env) across container recreation.
|
|
# env_file above still seeds the initial boot env from the same file.
|
|
- ./agent/.env:/app/agent/.env
|
|
# --- Runtime hardening (VT-007) ---
|
|
cap_drop:
|
|
- ALL
|
|
# SETUID/SETGID are kept on purpose: runner.py drops privilege to the
|
|
# unprivileged vibe-sandbox user for LLM-generated-code subprocesses, which
|
|
# needs setuid/setgid. They are granted from container start (not gained via
|
|
# escalation), so no-new-privileges below does not neutralize them.
|
|
cap_add:
|
|
- SETUID
|
|
- SETGID
|
|
security_opt:
|
|
- "no-new-privileges:true"
|
|
read_only: true
|
|
# Writable scratch on the read-only rootfs. Named volumes above already
|
|
# cover agent/runs, agent/sessions, agent/uploads, agent/.swarm/runs and
|
|
# /home/vibe/.vibe-trading; these tmpfs mounts cover /tmp and the cache dirs
|
|
# matplotlib/fontconfig write to during PDF rendering.
|
|
tmpfs:
|
|
- /tmp
|
|
- /home/vibe/.cache
|
|
- /home/vibe/.config
|
|
# Bound a single runaway backtest. Generous self-hosted defaults; override
|
|
# in a compose override file for constrained hosts.
|
|
mem_limit: 4g
|
|
cpus: 2
|
|
pids_limit: 512
|
|
restart: unless-stopped
|
|
|
|
frontend:
|
|
image: node:20@sha256:8f693eaa7e0a8e71560c9a82b55fd54c2ae920a2ba5d2cde28bac7d1c01c9ba5 # node:20 digest resolved 2026-07-13
|
|
working_dir: /app
|
|
ports:
|
|
- "127.0.0.1:5899:5899"
|
|
volumes:
|
|
- ./frontend:/app
|
|
environment:
|
|
- VITE_API_URL=http://vibe-trading:8899
|
|
command: sh -c "npm install && npm run dev -- --host --port 5899"
|
|
profiles:
|
|
- frontend
|
|
depends_on:
|
|
vibe-trading:
|
|
condition: service_started
|
|
|
|
volumes:
|
|
vibe-runs:
|
|
vibe-sessions:
|
|
vibe-home:
|
|
vibe-swarm-runs:
|
|
vibe-uploads:
|