docker-compose.yml

# base control-plane stack
#
# Default: postgres + validator + updater + socket-proxy + prism-challenge
# + design-challenge + design-egress-proxy.
# Master/owner host only:
#   docker compose --profile master up -d
# brings gateway as an additional service (D3).
#
# External images are digest-pinned (no floating tags).
# docker.sock is mounted ONLY on socket-proxy (read-only).
# Secrets: age-decrypted env files mode 0600 under deploy/env/ (never baked into images).

name: base

services:
  postgres:
    image: postgres@sha256:33f923b05f64ca54ac4401c01126a6b92afe839a0aa0a52bc5aeb5cc958e5f20
    restart: unless-stopped
    env_file:
      - path: ./deploy/env/postgres.env
        required: true
    volumes:
      - base-pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U \"$$POSTGRES_USER\" -d \"$$POSTGRES_DB\""]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 10s
    networks:
      - base
    # No host ports by default — apps reach postgres on the compose network.

  validator:
    image: validator:0.1.0
    build:
      context: .
      dockerfile: deploy/Dockerfile
      target: validator
      args:
        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    env_file:
      - path: ./deploy/env/validator.env
        required: true
    environment:
      BASE_ROLE: validator
      BASE_LISTEN: 0.0.0.0:8080
      # Optional co-located gateway (only present under profile master)
      BASE_GATEWAY_ENDPOINT: ${BASE_GATEWAY_ENDPOINT:-http://gateway:8080}
      # Owner-signed measurements for attest (image bakes /etc/base/config; host mount wins)
      BASE_TRUST_ROOT_DIR: ${BASE_TRUST_ROOT_DIR:-/etc/base/config}
    volumes:
      - ./config:/etc/base/config:ro
    expose:
      - "8080"
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -fsS -m 5 http://127.0.0.1:8080/healthz || exit 1",
        ]
      interval: 10s
      timeout: 3s
      retries: 6
      start_period: 15s
    networks:
      - base
    # No docker.sock — updater talks via socket-proxy only.

  gateway:
    profiles: ["master"]
    image: gateway:0.1.0
    build:
      context: .
      dockerfile: deploy/Dockerfile
      target: gateway
      args:
        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    env_file:
      - path: ./deploy/env/gateway.env
        required: true
    environment:
      BASE_ROLE: gateway
      BASE_GATEWAY_LISTEN: 0.0.0.0:8080
      BASE_TRUST_ROOT_DIR: ${BASE_TRUST_ROOT_DIR:-/etc/base/config}
      # Bundle seal mini-secret (host file, never baked into image)
      BASE_GATEWAY_SK_FILE: ${BASE_GATEWAY_SK_FILE:-/run/secrets/gateway_sk}
    volumes:
      - ./config:/etc/base/config:ro
      - ./deploy/secrets/gateway_sk:/run/secrets/gateway_sk:ro
    expose:
      - "8080"
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS -m 5 http://127.0.0.1:8080/healthz || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 6
      # The gateway resolves the subnet owner from chain before it listens.
      start_period: 30s
    networks:
      - base

  # ---------------------------------------------------------------------------
  # TEST-ONLY adversarial gateway (task 48). NEVER on default or master path.
  # Enable explicitly:
  #   docker compose --profile evil-gateway up -d evil-gateway
  # Do NOT use in production. Staging offline proofs live in
  # crates/validator/src/adversarial_tests.rs (FakeChain / wiremock).
  # ---------------------------------------------------------------------------
  evil-gateway:
    profiles: ["evil-gateway"]
    image: gateway:0.1.0
    build:
      context: .
      dockerfile: deploy/Dockerfile
      target: gateway
      args:
        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
    # Test harness — no auto-restart loop that could look like prod.
    restart: "no"
    depends_on:
      postgres:
        condition: service_healthy
    env_file:
      - path: ./deploy/env/gateway.env
        required: false
    environment:
      BASE_ROLE: gateway
      BASE_GATEWAY_LISTEN: 0.0.0.0:8080
      # Marker so operators never confuse with prod gateway (master profile).
      BASE_EVIL_GATEWAY: "1"
      BASE_EVIL_SCENARIO: ${BASE_EVIL_SCENARIO:-inconsistent-vector}
    expose:
      - "8080"
    networks:
      - base

  updater:
    image: updater:0.1.0
    build:
      context: .
      dockerfile: deploy/Dockerfile
      target: updater
      args:
        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
    # The updater pulls its desired image from a registry, so it is only useful
    # when BASE_UPDATER_DESIRED_IMAGE is a registry reference. remote-deploy.sh
    # enables this profile automatically in that case.
    profiles: ["auto-update"]
    restart: unless-stopped
    depends_on:
      socket-proxy:
        condition: service_started
      validator:
        condition: service_started
    env_file:
      - path: ./deploy/env/updater.env
        required: true
    environment:
      BASE_UPDATER_PROXY_URL: http://socket-proxy:2375
      BASE_UPDATER_COMPOSE_PROJECT: base
      BASE_UPDATER_SERVICE_NAME: validator
      BASE_UPDATER_HEALTH_URL: http://validator:8080/readyz
      BASE_UPDATER_STATE_DIR: /var/lib/base-updater
      BASE_UPDATER_SELF_NAME: base-updater-1
    volumes:
      - base-updater-state:/var/lib/base-updater
    networks:
      - base
    # Talks to Docker Engine only through socket-proxy (allowlisted).



  # ---------------------------------------------------------------------------
  # prism-challenge — operator PRISM challenge health + miner submit (:8092).
  # ---------------------------------------------------------------------------
  prism-challenge:
    image: prism-challenge:0.1.0
    build:
      context: .
      dockerfile: deploy/Dockerfile
      target: prism-challenge
      args:
        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      BASE_CHALLENGE_BIND: 0.0.0.0:8092
      BASE_CHALLENGE_SK_FILE: /run/base/challenge_sk
      # Real Lium is used whenever an API key is present. Set PRISM_FORCE_SIM=true
      # to keep a deployment on the offline deterministic backend (no GPU spend).
      PRISM_FORCE_SIM: "${PRISM_FORCE_SIM:-false}"
      LIUM_API_KEY_FILE: /run/base/lium/api_key
      LIUM_SSH_PRIVATE_KEY: /run/base/lium/ssh_ed25519
      LIUM_SSH_PUBLIC_KEY_FILE: /run/base/lium/ssh_ed25519.pub
      OPENROUTER_API_KEY_FILE: /run/base/openrouter/api_key
      BASE_CHALLENGE_GATEWAY_ENDPOINT: ${BASE_CHALLENGE_GATEWAY_ENDPOINT:-http://gateway:8080}
      PRISM_MAX_CONCURRENT_EVALS: "${PRISM_MAX_CONCURRENT_EVALS:-8}"
      # Pods need a while for sshd after RUNNING on the control plane.
      PRISM_SSH_ATTEMPTS: "${PRISM_SSH_ATTEMPTS:-30}"
      PRISM_SSH_RETRY_SECS: "${PRISM_SSH_RETRY_SECS:-10}"
      PRISM_SSH_RUNNING_TIMEOUT_SECS: "${PRISM_SSH_RUNNING_TIMEOUT_SECS:-900}"
      # Top-model GitHub publish (BaseIntelligence/prism top-model/): no-op
      # when the token file is absent/empty.
      PRISM_TOPMODEL_GITHUB_TOKEN_FILE: /run/base/github/token
    env_file:
      # Required: BASE_DATABASE_URL (+ BASE_NETUID). Missing file → compose
      # fails closed (binaries would otherwise fall back to in-memory store).
      - path: ./deploy/env/prism-challenge.env
        required: true
    volumes:
      # prism signs with its OWN mini secret:
      # the gateway verifies leaves against the trust root per-challenge key.
      - ./deploy/secrets/prism_sk:/run/base/challenge_sk:ro
      - ./deploy/secrets/lium:/run/base/lium:ro
      - ./deploy/secrets/openrouter:/run/base/openrouter:ro
      - ./deploy/secrets/github:/run/base/github:ro
    expose:
      - "8092"
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -fsS -m 5 http://127.0.0.1:8092/health || exit 1",
        ]
      interval: 10s
      timeout: 3s
      retries: 6
      start_period: 10s
    networks:
      - base

  # ---------------------------------------------------------------------------
  # design-egress-proxy — open Internet egress for sandboxes (install + run)
  # with an internal-target blocklist (metadata / loopback / RFC1918 / CGNAT /
  # control-plane names, enforced post-DNS-resolution) plus the budgeted
  # OpenRouter chat path. Holds OPENROUTER key; never mount design_sk here.
  # On base + internal design-sandbox-egress so sandboxes can reach it without
  # direct internet.
  # ---------------------------------------------------------------------------
  design-egress-proxy:
    image: design-egress-proxy:0.1.0
    build:
      context: .
      dockerfile: deploy/Dockerfile
      target: design-egress-proxy
      args:
        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
    restart: unless-stopped
    environment:
      DESIGN_EGRESS_BIND: 0.0.0.0:8094
      OPENROUTER_API_KEY_FILE: /run/base/openrouter/api_key
      DESIGN_TOKEN_BUDGET: "${DESIGN_TOKEN_BUDGET:-8000}"
      DESIGN_EGRESS_SIM: "${DESIGN_EGRESS_SIM:-false}"
    env_file:
      - path: ./deploy/env/design-egress-proxy.env
        required: false
    volumes:
      - ./deploy/secrets/openrouter:/run/base/openrouter:ro
    expose:
      - "8094"
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -fsS -m 5 http://127.0.0.1:8094/health || exit 1",
        ]
      interval: 10s
      timeout: 3s
      retries: 6
      start_period: 10s
    networks:
      - base
      - design-sandbox-egress

  # ---------------------------------------------------------------------------
  # design-challenge — miner harness API + sandbox orchestrator (:8093).
  # Docker ONLY via socket-proxy (DESIGN_DOCKER_BASE). No raw docker.sock.
  # Sandbox LLM traffic goes through design-egress-proxy (no key in sandbox).
  # Agentic anti-cheat on this service needs the OpenRouter key at the default
  # DESIGN_AGENTIC_OPENROUTER_KEY_FILE path (never passed into miner sandboxes).
  # ---------------------------------------------------------------------------
  design-challenge:
    image: design-challenge:0.1.0
    build:
      context: .
      dockerfile: deploy/Dockerfile
      target: design-challenge
      args:
        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
      socket-proxy:
        condition: service_started
      design-egress-proxy:
        condition: service_healthy
    environment:
      BASE_CHALLENGE_BIND: 0.0.0.0:8093
      BASE_CHALLENGE_SK_FILE: /run/base/challenge_sk
      DESIGN_FORCE_SIM: "${DESIGN_FORCE_SIM:-false}"
      DESIGN_DOCKER_BASE: http://socket-proxy:2375
      # Host path must equal bind source below (daemon resolves binds on host).
      DESIGN_STAGING_ROOT: ${BASE_STATE_DIR:-/var/lib/base}/design/staging
      DESIGN_LLM_PROXY: http://design-egress-proxy:8094
      # Screenshot Chromium (--no-sandbox, file://) must not reach control-plane
      # targets on the shared `base` network: force all http(s) through the
      # egress proxy blocklist (incl. loopback/metadata via <-loopback>).
      DESIGN_SCREENSHOT_PROXY: http://design-egress-proxy:8094
      DESIGN_ANNOTATOR_TOKENS_FILE: /run/base/design/annotator_tokens
      DESIGN_AGENTIC_OPENROUTER_KEY_FILE: /run/base/openrouter/api_key
      DESIGN_MAX_CONCURRENT: "${DESIGN_MAX_CONCURRENT:-2}"
      DESIGN_INSTALL_TIMEOUT_SECS: "${DESIGN_INSTALL_TIMEOUT_SECS:-300}"
      BASE_CHALLENGE_GATEWAY_ENDPOINT: ${BASE_CHALLENGE_GATEWAY_ENDPOINT:-http://gateway:8080}
    env_file:
      # Required: BASE_DATABASE_URL (+ BASE_NETUID). Missing file → compose
      # fails closed (binaries would otherwise fall back to in-memory store).
      - path: ./deploy/env/design-challenge.env
        required: true
    volumes:
      - ./deploy/secrets/design_sk:/run/base/challenge_sk:ro
      - ./deploy/secrets/design:/run/base/design:ro
      - ./deploy/secrets/openrouter:/run/base/openrouter:ro
      - design-artifacts:/var/lib/design
      - ${BASE_STATE_DIR:-/var/lib/base}/design/staging:${BASE_STATE_DIR:-/var/lib/base}/design/staging
    expose:
      - "8093"
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -fsS -m 5 http://127.0.0.1:8093/health || exit 1",
        ]
      interval: 10s
      timeout: 3s
      retries: 6
      start_period: 15s
    networks:
      - base

  socket-proxy:
    image: tecnativa/docker-socket-proxy@sha256:9e4b9e7517a6b660f2cc903a19b257b1852d5b3344794e3ea334ff00ae677ac2
    restart: unless-stopped
    environment:
      # Shared proxy: updater rolls + design-challenge sandbox. App-level
      # Allowlist::updater / Allowlist::verifier enforce method/path; tecnativa
      # CONTAINERS includes DELETE for sandbox cleanup. NETWORKS stays off —
      # design-sandbox-egress is pre-created by compose (NetworkMode by name).
      CONTAINERS: "1"
      IMAGES: "1"
      POST: "1"
      # Everything else denied (explicit zeros for clarity)
      ALLOW_START: "1"
      ALLOW_STOP: "1"
      ALLOW_RESTARTS: "0"
      AUTH: "0"
      BUILD: "0"
      COMMIT: "0"
      CONFIGS: "0"
      DISTRIBUTION: "0"
      EVENTS: "1"
      EXEC: "0"
      INFO: "0"
      NETWORKS: "0"
      NODES: "0"
      PLUGINS: "0"
      SERVICES: "0"
      SESSION: "0"
      SWARM: "0"
      SYSTEM: "0"
      TASKS: "0"
      SECRETS: "0"
      VOLUMES: "0"
    volumes:
      # Sole host docker.sock mount on this stack (read-only).
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - base
    # Bound only on the internal network — never publish 2375 to the host.

volumes:
  base-pgdata:
  base-updater-state:
  design-artifacts:

networks:
  base:
    driver: bridge
  # Sandbox containers attach here (NetworkMode); only egress member is
  # design-egress-proxy. internal=true blocks direct internet from sandboxes.
  # Pin the Docker name so NetworkMode "design-sandbox-egress" matches (no
  # compose project prefix) — socket-proxy cannot create networks at runtime.
  design-sandbox-egress:
    name: design-sandbox-egress
    driver: bridge
    internal: true