docker-compose.yml

services:
  volume-init:
    image: manjarolinux/base:latest
    env_file:
      - .env
    volumes:
      - ./scripts/init-volumes.sh:/init-volumes.sh:ro
      - ./extra/mounts/security-tools:/mnt/security-tools
      - ./extra/mounts/go-cache:/mnt/go-cache
      - ./extra/mounts/shell-history:/mnt/shell-history
      - ./extra/mounts/git-tools:/mnt/git-tools
      - ./extra/mounts/aws-config:/mnt/aws-config
      - ./extra/mounts/vscode-config:/mnt/vscode-config
      - ./extra/mounts/npm-cache:/mnt/npm-cache
      - ./extra/mounts/docker-config:/mnt/docker-config
      - ./extra/mounts/nvim-cache:/mnt/nvim-cache
      - ./extra/mounts/antigravity-cache:/mnt/antigravity-cache
      - ./extra/mounts/gemini-cache:/mnt/gemini-cache
    command: [ "sh", "/init-volumes.sh" ]

  docker-proxy:
    image: tecnativa/docker-socket-proxy:latest
    container_name: docker-proxy
    privileged: true
    environment:
      - CONTAINERS=1
      - IMAGES=1
      - NETWORKS=1
      - VOLUMES=1
      - BUILD=1
      - EXEC=1
      - POST=1
      - SWARM=0
      - NODES=0
      - PLUGINS=0
      - SYSTEM=0
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    restart: unless-stopped
    networks:
      - dev-network

  dev-env:
    depends_on:
      volume-init:
        condition: service_completed_successfully
      docker-proxy:
        condition: service_started
    environment:
      - DOCKER_HOST=tcp://docker-proxy:2375
      - SSH_AUTH_SOCK=/run/host-services/ssh-auth.sock
      - TZ=${TZ:-UTC}
    build:
      context: .
      args:
        - BUILD_DATE=${BUILD_DATE:-}
        - USERNAME=${DEV_USER:-dev}
        - USER_UID=${DEV_USER_ID:-1001}
        - USER_GID=${DEV_GROUP_ID:-1001}
    image: ${COMPOSE_PROJECT_NAME:-dotfiles}-dev-env
    container_name: ${COMPOSE_PROJECT_NAME:-dotfiles}-dev-environment
    env_file:
      - .env
    user: "${DEV_USER_ID:-1001}:${DEV_GROUP_ID:-1001}"
    init: true
    healthcheck:
      test: [ "CMD", "pgrep", "sshd" ]
      interval: 30s
      timeout: 10s
      start_period: 15s
      retries: 3
    labels:
      - "com.docker.compose.project=${COMPOSE_PROJECT_NAME:-dotfiles}"
      - "dev.environment.type=development"
    tmpfs:
      - /tmp:noexec,nosuid,nodev,size=500m
      - /run:noexec,nosuid,nodev,size=100m
    security_opt:
      - no-new-privileges:true
    ports:
      - "${HOST_SSH_PORT:-2222}:2222"
      - "${HOST_WEB_PORT:-8080}:8080"
      - "3000:3000"
      - "9000:9000"
    volumes:
      - ${HOST_WORKSPACE:-./workspace}:/workspace
      - ./configs/nvim:/home/${DEV_USER:-dev}/.config/nvim
      - ./configs/.zshrc:/home/${DEV_USER:-dev}/.zshrc:ro
      - ./configs/.tmux.conf:/home/${DEV_USER:-dev}/.tmux.conf:ro
      - ./configs/linux/etc/ssh/sshd_config:/etc/ssh/sshd_config:ro
      - ./configs/linux/etc/sysctl.d/99-optimized.conf:/etc/sysctl.d/99-optimized.conf:ro
      - ./configs/linux/etc/profile.d:/etc/profile.d:ro
      - ./configs/linux/etc/locale.conf:/etc/locale.conf:ro
      - ./configs/linux/etc/timezone:/etc/timezone:ro
      - ./configs/linux/etc/security:/etc/security:ro

      - /run/host-services/ssh-auth.sock:/run/host-services/ssh-auth.sock # Forward SSH Agent

      - ./extra/mounts/security-tools:/home/${DEV_USER:-dev}/.security
      - ./extra/mounts/go-cache:/home/${DEV_USER:-dev}/.go-cache
      - ./extra/mounts/shell-history:/home/${DEV_USER:-dev}/.shell_history
      - ./extra/mounts/git-tools:/home/${DEV_USER:-dev}/.git_tools
      - ./extra/mounts/aws-config:/home/${DEV_USER:-dev}/.aws
      - ./extra/mounts/vscode-config:/home/${DEV_USER:-dev}/.vscode
      - ./extra/mounts/npm-cache:/home/${DEV_USER:-dev}/.npm
      - ./extra/mounts/nvim-cache:/home/${DEV_USER:-dev}/.local/share/nvim
      - ./extra/mounts/antigravity-cache:/home/${DEV_USER:-dev}/.antigravity
      - ./extra/mounts/gemini-cache:/home/${DEV_USER:-dev}/.gemini

      - ./extra/mounts/docker-config:/home/${DEV_USER:-dev}/.docker

    stdin_open: true
    tty: true
    restart: unless-stopped
    networks:
      - dev-network

networks:
  dev-network:
    driver: bridge
    driver_opts:
      com.docker.network.bridge.enable_icc: "true"
      com.docker.network.bridge.enable_ip_masquerade: "true"
      com.docker.network.bridge.host_binding_ipv4: "0.0.0.0"
    ipam:
      driver: default
      config:
        - subnet: ${DOCKER_SUBNET:-172.20.0.0/16}