docker-compose.yml

services:
  odin-bot:
    build: .
    container_name: odin-bot
    restart: unless-stopped
    env_file: .env
    environment:
      - TZ=${TZ:-UTC}
      - OLLAMA_URL=${OLLAMA_URL:-http://host.docker.internal:11434}
    volumes:
      - ./config:/app/config
      - ./config.yml:/app/config.yml:ro
      - ./data:/app/data
      # NAMED volume, not a bind mount: Docker initializes a named volume from
      # the image directory, preserving the 0700 ownership the resolver
      # requires. A fresh bind mount is created 755 root:root, which fails
      # closed and costs local-command capability on first run (PR #239 r2).
      - odin-workspace:/var/lib/odin-workspace
      - ./data/context:/app/data/context:ro
      - ./ssh:/app/.ssh:ro
    extra_hosts:
      - "host.docker.internal:host-gateway"
    ports:
      - "127.0.0.1:3939:3000"
    networks:
      - default
    # Existing deployments keep their old config.yml bind until the entrypoint
    # copies it once into the writable directory mount. Never overwrite there.
    command: ["sh", "/app/docker-compose-entrypoint.sh"]

  odin-browser:
    image: ghcr.io/browserless/chromium
    container_name: odin-browser
    restart: unless-stopped
    profiles:
      - browser
    environment:
      - CONCURRENT=2
      - TIMEOUT=30000
      - QUEUED=5
      - HEALTH=true
      - TOKEN=${BROWSER_TOKEN:-odin-internal}
    deploy:
      resources:
        limits:
          memory: 1g
    networks:
      - default

volumes:
  # Local command workspace (tools.local_working_dir). Initialized from the
  # image's 0700 directory so a fresh deployment satisfies the resolver.
  odin-workspace: