name: pi-agi-open-mission

services:
  proxy:
    build:
      context: .
      dockerfile: Dockerfile.proxy
    read_only: true
    tmpfs:
      - /tmp:mode=1777
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 128
    mem_limit: 256m
    init: true
    restart: unless-stopped
    networks:
      - sandbox
      - egress
    healthcheck:
      test:
        - CMD
        - node
        - -e
        - "fetch('http://127.0.0.1:3128/health').then(r=>{if(!r.ok)process.exit(1)}).catch(()=>process.exit(1))"
      interval: 1s
      timeout: 2s
      retries: 30

  agent:
    build:
      context: ../..
      dockerfile: sandbox/open-mission/Dockerfile.agent
    depends_on:
      proxy:
        condition: service_healthy
    environment:
      PI_CODING_AGENT_DIR: /root/.pi/agent
      PI_AGI_PI_BINARY: /usr/local/bin/pi
      HTTP_PROXY: http://proxy:3128
      HTTPS_PROXY: http://proxy:3128
      http_proxy: http://proxy:3128
      https_proxy: http://proxy:3128
      ALL_PROXY: http://proxy:3128
      all_proxy: http://proxy:3128
      NO_PROXY: localhost,127.0.0.1,::1,proxy
      no_proxy: localhost,127.0.0.1,::1,proxy
      NODE_USE_ENV_PROXY: "1"
    volumes:
      - "${PI_AGI_SANDBOX_AGENT_DIR:-./agent-config}:/config-ro:ro"
      - workspace:/workspace
    tmpfs:
      - /tmp:mode=1777
      - /root/.pi/agent:mode=0700
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
      - SETGID
      - SETUID
    security_opt:
      - no-new-privileges:true
    pids_limit: 512
    mem_limit: 3g
    shm_size: 1g
    init: true
    networks:
      - sandbox

networks:
  sandbox:
    internal: true
  egress: {}

volumes:
  workspace: