docker-compose.yml

# Agent Studio one-box deployment. The default uses published images and a
# persistent, one-shot credential bootstrap. Source builds are under dev only.
name: agent-studio

x-logging: &bounded-logs
  driver: json-file
  options: {max-size: "10m", max-file: "3"}

x-task-server: &task-server
  restart: unless-stopped
  depends_on:
    bootstrap: {condition: service_completed_successfully}
  ports:
    - "127.0.0.1:${STUDIO_TASKSERVER_PORT:-5071}:5071"
  environment:
    LISTEN_URL: http://0.0.0.0:5071
    STORE_PATH: /var/lib/agent-orchestrator/store
    BACKUP_PATH: /var/lib/agent-orchestrator/backup
    AUTH: bearer
    STUDIO_AUTH_TOKEN_FILE: /run/agent-studio-secrets/studio_token
    ENGINE_AUTH_TOKEN_FILE: /run/agent-studio-secrets/engine_token
    BOOTSTRAP_RUNNER_ID: distributed-runner
    BOOTSTRAP_RUNNER_AUTH_TOKEN_FILE: /run/agent-studio-secrets/runner_token
  volumes:
    - store:/var/lib/agent-orchestrator/store
    - backup:/var/lib/agent-orchestrator/backup
    - secrets:/run/agent-studio-secrets:ro
  networks: [control]
  mem_limit: 2g
  cpus: 2
  healthcheck:
    test: ["CMD", "curl", "--fail", "--silent", "http://127.0.0.1:5071/readyz"]
    interval: 5s
    timeout: 3s
    retries: 24
    start_period: 10s
  logging: *bounded-logs

x-engine: &engine
  restart: unless-stopped
  environment:
    SERVER_URL: http://task-server:5071
    CLIENT_ID: orchestrator-engine
    CLIENT_CREDENTIAL_FILE: /run/agent-studio-secrets/engine_token
    ENGINE_ALLOW_INSECURE_HTTP: "1"
  volumes:
    - secrets:/run/agent-studio-secrets:ro
  networks: [control]
  mem_limit: 1g
  cpus: 2
  healthcheck:
    test: ["CMD", "dotnet", "orchestrator-engine.dll", "--health-check"]
    interval: 10s
    timeout: 5s
    retries: 6
    start_period: 15s
  logging: *bounded-logs

x-bff: &bff
  restart: unless-stopped
  environment:
    TaskServer__BaseUrl: http://task-server:5071
    TaskServer__AuthTokenFile: /run/agent-studio-secrets/studio_token
  volumes:
    - secrets:/run/agent-studio-secrets:ro
  networks: [control]
  mem_limit: 512m
  cpus: 1
  healthcheck:
    test: ["CMD", "curl", "--fail", "--silent", "http://127.0.0.1:5072/healthz"]
    interval: 5s
    timeout: 3s
    retries: 24
    start_period: 10s
  logging: *bounded-logs

x-api: &api
  restart: unless-stopped
  environment:
    TaskRepository: /data/workspace
    TaskServer__BaseUrl: http://task-server:5071
    TaskServer__AuthTokenFile: /run/agent-studio-secrets/studio_token
  volumes:
    - workspace:/data/workspace
    - projects:/data/projects
    - secrets:/run/agent-studio-secrets:ro
  networks: [control]
  mem_limit: 2g
  cpus: 2
  healthcheck:
    test: ["CMD", "curl", "--fail", "--silent", "http://127.0.0.1:5031/healthz"]
    interval: 5s
    timeout: 3s
    retries: 24
    start_period: 10s
  logging: *bounded-logs

x-web: &web
  restart: unless-stopped
  ports:
    - "${STUDIO_UI_BIND:-127.0.0.1}:${STUDIO_UI_PORT:-4011}:8080"
  environment:
    STUDIO_API_UPSTREAM: orchestrator-api:5031
    STUDIO_BFF_UPSTREAM: studio-bff:5072
  networks: [control]
  mem_limit: 512m
  cpus: 1
  healthcheck:
    test: ["CMD", "wget", "--quiet", "--output-document=-", "http://127.0.0.1:8080/healthz"]
    interval: 5s
    timeout: 3s
    retries: 12
    start_period: 5s
  logging: *bounded-logs

x-runner: &runner
  restart: unless-stopped
  environment:
    RUNNER_SERVER_URL: http://task-server:5071
    RUNNER_ID: distributed-runner
    RUNNER_NAME: distributed-runner
    RUNNER_ALLOW_INSECURE_HTTP: "1"
    RUNNER_AUTH_TOKEN_FILE: /run/agent-studio-secrets/runner_token
    RUNNER_GIT_REMOTE: ${RUNNER_GIT_REMOTE:-}
    RUNNER_GIT_PUSH_REMOTE: ${RUNNER_GIT_PUSH_REMOTE:-}
    GIT_CONFIG_COUNT: "1"
    GIT_CONFIG_KEY_0: credential.helper
    GIT_CONFIG_VALUE_0: store --file=/home/runner/.git-credentials
  volumes:
    - runner-workspaces:/var/lib/agent-host
    - secrets:/run/agent-studio-secrets:ro
    - ${RUNNER_CLAUDE_CREDENTIALS_DIR:-./deploy/compose/empty-credentials}:/home/runner/.claude
    - ${RUNNER_CODEX_CREDENTIALS_DIR:-./deploy/compose/empty-credentials}:/home/runner/.codex
    - ${RUNNER_GEMINI_CREDENTIALS_DIR:-./deploy/compose/empty-credentials}:/home/runner/.config/gemini
    - ${RUNNER_SSH_CREDENTIALS_DIR:-./deploy/compose/empty-credentials}:/home/runner/.ssh:ro
    - ${RUNNER_GIT_CREDENTIALS_FILE:-./deploy/compose/empty-credentials/git-credentials}:/home/runner/.git-credentials:ro
  networks: [control, runner]
  mem_limit: 4g
  cpus: 4
  healthcheck:
    test: ["CMD", "dotnet", "/opt/agent-host/agent-host.dll", "--health-check"]
    interval: 15s
    timeout: 10s
    retries: 6
    start_period: 20s
  logging: *bounded-logs

services:
  bootstrap:
    image: ghcr.io/agent-orc/agent-task-server:v${AGENT_STUDIO_VERSION:-0.9.1}
    user: "0:0"
    entrypoint: ["/bin/sh", "/opt/compose-secret-bootstrap.sh"]
    restart: "no"
    volumes:
      - secrets:/run/agent-studio-secrets
      - store:/var/lib/agent-orchestrator/store
      - backup:/var/lib/agent-orchestrator/backup
      - workspace:/data/workspace
      - projects:/data/projects
      - runner-workspaces:/var/lib/agent-host
      - ./scripts/compose-secret-bootstrap.sh:/opt/compose-secret-bootstrap.sh:ro
    networks: [control]
    mem_limit: 128m
    cpus: 0.5
    logging: *bounded-logs

  task-server:
    <<: *task-server
    image: ghcr.io/agent-orc/agent-task-server:v${AGENT_STUDIO_VERSION:-0.9.1}

  credential-manager:
    image: ghcr.io/agent-orc/agent-task-server:v${AGENT_STUDIO_VERSION:-0.9.1}
    profiles: [ops]
    user: "0:0"
    entrypoint: ["/bin/sh", "/opt/compose-rotate-credentials.sh"]
    volumes:
      - secrets:/run/agent-studio-secrets
      - ./scripts/compose-rotate-credentials.sh:/opt/compose-rotate-credentials.sh:ro
    networks: [control]
    mem_limit: 128m
    cpus: 0.5
    logging: *bounded-logs

  orchestrator-engine:
    <<: *engine
    image: ghcr.io/agent-orc/agent-orchestrator-engine:v${AGENT_STUDIO_VERSION:-0.9.1}
    depends_on:
      task-server: {condition: service_healthy}

  studio-bff:
    <<: *bff
    image: ghcr.io/agent-orc/agent-studio-bff:v${AGENT_STUDIO_VERSION:-0.9.1}
    depends_on:
      task-server: {condition: service_healthy}

  orchestrator-api:
    <<: *api
    image: ghcr.io/agent-orc/agent-studio-api:v${AGENT_STUDIO_VERSION:-0.9.1}
    depends_on:
      task-server: {condition: service_healthy}

  web:
    <<: *web
    image: ghcr.io/agent-orc/agent-studio-web:v${AGENT_STUDIO_VERSION:-0.9.1}
    depends_on:
      orchestrator-api: {condition: service_healthy}
      studio-bff: {condition: service_healthy}

  agent-host-distributed:
    <<: *runner
    image: ghcr.io/agent-orc/agent-host:v${AGENT_STUDIO_VERSION:-0.9.1}
    depends_on:
      task-server: {condition: service_healthy}

  edge:
    image: caddy:${CADDY_VERSION:-2.10-alpine}
    profiles: [edge]
    restart: unless-stopped
    ports:
      - "${STUDIO_EDGE_BIND:-127.0.0.1}:${STUDIO_EDGE_PORT:-8443}:443"
    environment:
      STUDIO_EDGE_HOSTNAME: ${STUDIO_EDGE_HOSTNAME:-localhost}
    volumes:
      - ./deploy/compose/Caddyfile.edge:/etc/caddy/Caddyfile:ro
      - edge-data:/data
      - edge-config:/config
    networks: [control]
    depends_on:
      web: {condition: service_healthy}
    mem_limit: 256m
    cpus: 1
    logging: *bounded-logs

  task-server-dev:
    <<: *task-server
    build: {context: ., dockerfile: task-server/Dockerfile, args: {VERSION: "${AGENT_STUDIO_VERSION:-0.0.0-dev}"}}
    depends_on:
      bootstrap-dev: {condition: service_completed_successfully}
    profiles: [dev]

  credential-manager-dev:
    build: {context: ., dockerfile: task-server/Dockerfile, args: {VERSION: "${AGENT_STUDIO_VERSION:-0.0.0-dev}"}}
    profiles: [dev]
    user: "0:0"
    entrypoint: ["/bin/sh", "/opt/compose-rotate-credentials.sh"]
    environment:
      TASK_SERVER_URL: http://task-server-dev:5071
    volumes:
      - secrets:/run/agent-studio-secrets
      - ./scripts/compose-rotate-credentials.sh:/opt/compose-rotate-credentials.sh:ro
    networks: [control]
    mem_limit: 128m
    cpus: 0.5
    logging: *bounded-logs

  bootstrap-dev:
    build: {context: ., dockerfile: task-server/Dockerfile, args: {VERSION: "${AGENT_STUDIO_VERSION:-0.0.0-dev}"}}
    user: "0:0"
    entrypoint: ["/bin/sh", "/opt/compose-secret-bootstrap.sh"]
    restart: "no"
    volumes:
      - secrets:/run/agent-studio-secrets
      - store:/var/lib/agent-orchestrator/store
      - backup:/var/lib/agent-orchestrator/backup
      - workspace:/data/workspace
      - projects:/data/projects
      - runner-workspaces:/var/lib/agent-host
      - ./scripts/compose-secret-bootstrap.sh:/opt/compose-secret-bootstrap.sh:ro
    networks: [control]
    mem_limit: 128m
    cpus: 0.5
    logging: *bounded-logs
    profiles: [dev]

  orchestrator-engine-dev:
    <<: *engine
    build: {context: ., dockerfile: orchestrator-engine/Dockerfile, args: {VERSION: "${AGENT_STUDIO_VERSION:-0.0.0-dev}"}}
    environment:
      SERVER_URL: http://task-server-dev:5071
      CLIENT_ID: orchestrator-engine
      CLIENT_CREDENTIAL_FILE: /run/agent-studio-secrets/engine_token
      ENGINE_ALLOW_INSECURE_HTTP: "1"
    depends_on:
      task-server-dev: {condition: service_healthy}
    profiles: [dev]

  studio-bff-dev:
    <<: *bff
    build: {context: ., dockerfile: studio-bff/Dockerfile, args: {VERSION: "${AGENT_STUDIO_VERSION:-0.0.0-dev}"}}
    environment:
      TaskServer__BaseUrl: http://task-server-dev:5071
      TaskServer__AuthTokenFile: /run/agent-studio-secrets/studio_token
    depends_on:
      task-server-dev: {condition: service_healthy}
    profiles: [dev]

  orchestrator-api-dev:
    <<: *api
    build: {context: ., dockerfile: backend/Dockerfile, args: {VERSION: "${AGENT_STUDIO_VERSION:-0.0.0-dev}"}}
    environment:
      TaskRepository: /data/workspace
      TaskServer__BaseUrl: http://task-server-dev:5071
      TaskServer__AuthTokenFile: /run/agent-studio-secrets/studio_token
    depends_on:
      task-server-dev: {condition: service_healthy}
    profiles: [dev]

  web-dev:
    <<: *web
    build: {context: ., dockerfile: frontend/Dockerfile, args: {VERSION: "${AGENT_STUDIO_VERSION:-0.0.0-dev}"}}
    environment:
      STUDIO_API_UPSTREAM: orchestrator-api-dev:5031
      STUDIO_BFF_UPSTREAM: studio-bff-dev:5072
    depends_on:
      orchestrator-api-dev: {condition: service_healthy}
      studio-bff-dev: {condition: service_healthy}
    profiles: [dev]

  agent-host-distributed-dev:
    <<: *runner
    build: {context: ., dockerfile: runner/Dockerfile, args: {VERSION: "${AGENT_STUDIO_VERSION:-0.0.0-dev}"}}
    environment:
      RUNNER_SERVER_URL: http://task-server-dev:5071
      RUNNER_ID: distributed-runner
      RUNNER_NAME: distributed-runner
      RUNNER_ALLOW_INSECURE_HTTP: "1"
      RUNNER_AUTH_TOKEN_FILE: /run/agent-studio-secrets/runner_token
      RUNNER_GIT_REMOTE: ${RUNNER_GIT_REMOTE:-}
      RUNNER_GIT_PUSH_REMOTE: ${RUNNER_GIT_PUSH_REMOTE:-}
      GIT_CONFIG_COUNT: "1"
      GIT_CONFIG_KEY_0: credential.helper
      GIT_CONFIG_VALUE_0: store --file=/home/runner/.git-credentials
    depends_on:
      task-server-dev: {condition: service_healthy}
    profiles: [dev]

volumes:
  store:
  backup:
  workspace:
  projects:
  runner-workspaces:
  secrets:
  edge-data:
  edge-config:

networks:
  control:
    internal: false
  runner:
    internal: false