docker-compose.yml

# Warren home-server compose file.
#
# `docker compose up -d` on a fresh clone PULLS the published control-plane
# image from ghcr.io (warren-26be) — it does not build from source. Pin a
# release with `WARREN_IMAGE_TAG=v0.10.4` (or the moving minor, `0.10`) in
# .env or the environment; the default `latest` tracks main.
#
# It boots a single warren container with:
#   - the four bwrap-friendly security flags (docs/design/runtime-and-supervisor.md / mx-94901b /
#     mx-c085ba). They relax the outer container so warren's own bwrap
#     userns sandboxes can come up (warren runs bwrap itself since the
#     burrow daemon was internalized, warren-9a26).
#   - a named volume mounted at /data for warren.db (SQLite default)
#     and cloned project repos. When WARREN_DB_URL points at an external
#     Postgres (R-13, shipped 2026-05-14), warren.db is unused but the
#     volume still holds project clones, so the mount stays in place
#     either way.
#   - the runtime env loaded from .env (`cp .env.example .env` first).
#
# The supervisor inside the container spawns `warren` as its single child
# and forwards signals to it — there is no burrow service anywhere in this
# topology (warren-9a26), so no BURROW_API_TOKEN / WARREN_BURROW_TOKEN /
# WARREN_BURROW_SOCKET belongs in .env. See
# docs/design/runtime-and-supervisor.md for the supervisor contract and src/supervisor/main.ts for
# the implementation.

services:
  warren:
    image: ghcr.io/jayminwest/warren:${WARREN_IMAGE_TAG:-latest}
    # Contributors who want to run THIS checkout instead of the published
    # image: uncomment the build block and `docker compose up -d --build`.
    # Compose then builds from the local Dockerfile and tags the result as
    # the `image:` above, so nothing else in this file has to change.
    # build:
    #   context: .
    #   dockerfile: Dockerfile
    container_name: warren
    restart: unless-stopped

    # Required for nested bwrap (docs/design/runtime-and-supervisor.md, mx-94901b/mx-c085ba). Remove
    # any one of these and warren's in-process sandbox engine cannot bring
    # up a bwrap sandbox inside the container.
    security_opt:
      - apparmor=unconfined
      - seccomp=unconfined
      - systempaths=unconfined
    cap_add:
      - SYS_ADMIN

    ports:
      - "${WARREN_HOST_PORT:-8080}:8080"
      # Dedicated path-mode preview origin (warren-3f8a): previews are
      # served from WARREN_PREVIEW_PORT (default: bind port + 1) so
      # agent-authored preview code cannot read the operator token off
      # the warren UI origin. Publish it next to the API port.
      - "${WARREN_HOST_PREVIEW_PORT:-8081}:8081"

    # Cap and rotate container logs (warren-26c2 / pl-f700 step 4) so the
    # per-request access log can't fill the host disk. json-file is the
    # default driver; the options bound each file to 10MB and keep 5
    # rotated files (50MB ceiling per container).
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "5"

    # Long-form so a missing .env on a fresh clone is not a hard error
    # (warren-9cda). Compose concatenates env_file across base+overrides,
    # so the base entry itself must tolerate the file being absent — an
    # override cannot suppress it.
    env_file:
      - path: .env
        required: false

    volumes:
      - warren_data:/data

volumes:
  warren_data: