model-platform/docker-compose.yml

services:
  migrate:
    build:
      context: .
      dockerfile: backend/Dockerfile
    restart: "no"
    command:
      - uv
      - run
      - --frozen
      - --package
      - backend
      - alembic
      - upgrade
      - head
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      INITIAL_ADMIN_PASSWORD: ${INITIAL_ADMIN_PASSWORD:-admin12345}

  web:
    build:
      context: .
      dockerfile: frontend/Dockerfile
    restart: unless-stopped
   # Architecture §2.2: this is the only service exposed to the host. The
    # default.conf file is mounted as a template; scripts/nginx-entrypoint.sh
    # parses ${S3_ENDPOINT} and writes the rendered config to
    # /etc/nginx/conf.d/default.conf before exec'ing nginx.
    ports:
      - "${GATEWAY_PORT:-8888}:80"
    environment:
      S3_ENDPOINT: ${S3_ENDPOINT:?S3_ENDPOINT is required}
    depends_on:
      backend:
        condition: service_healthy
      runtime:
        condition: service_healthy
    volumes:
      - ./frontend/build/client:/usr/share/nginx/html
    healthcheck:
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1/ >/dev/null"]
      interval: 10s
      timeout: 3s
      retries: 12
      start_period: 10s

  backend:
    build:
      context: .
      dockerfile: backend/Dockerfile
    restart: unless-stopped
   # No host port: architecture §2.2 — only Nginx is externally reachable.
    # No local-FS volume: backend stores everything in S3 (S3_*).
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      SERVICE_NAME: model-platform-backend
      SCHEDULE_EVENT_NAMESPACE: ${SCHEDULE_EVENT_NAMESPACE:-model-platform-local}
      JWT_SECRET: ${JWT_SECRET:?JWT_SECRET is required}
      DEMO_AUTH_ENABLED: ${DEMO_AUTH_ENABLED:-false}
      INITIAL_ADMIN_PASSWORD: ${INITIAL_ADMIN_PASSWORD:-admin12345}
      RUNTIME_API_URL: http://runtime:8000
      STORAGE_BACKEND: ${STORAGE_BACKEND:-s3}
      LOCAL_STORAGE_BASE_DIR: ${LOCAL_STORAGE_BASE_DIR:-/data}
      # S3_* only matter when STORAGE_BACKEND=s3. Defaults are kept so local
      # mode boots without them; override in .env when switching to s3.
      S3_ENDPOINT: ${S3_ENDPOINT:-http://s3:9000}
      S3_ACCESS_KEY: ${S3_ACCESS_KEY:-}
      S3_SECRET_KEY: ${S3_SECRET_KEY:-}
      S3_WORKSPACE_BUCKET: ${S3_WORKSPACE_BUCKET:-workspaces}
      S3_VERSION_BUCKET: ${S3_VERSION_BUCKET:-versions}
      S3_RUN_LOG_BUCKET: ${S3_RUN_LOG_BUCKET:-run-logs}
      S3_TRASH_BUCKET: ${S3_TRASH_BUCKET:-trash}
      S3_TRASH_RETENTION_DAYS: ${S3_TRASH_RETENTION_DAYS:-30}
      READINESS_TARGETS: ${MYSQL_HOST:?MYSQL_HOST is required}:${MYSQL_PORT:-3306},${S3_HOST:-s3}:${S3_PORT:-9000},runtime:8000
    depends_on:
      migrate:
        condition: service_completed_successfully
      runtime:
        condition: service_healthy
    volumes:
      - ./backend:/app/backend
      - ./common:/app/common
      - ./data:/data
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8000/health/ready >/dev/null"]
      interval: 10s
      timeout: 5s
      retries: 18
      start_period: 20s

  runtime:
    build:
      context: .
      dockerfile: runtime/Dockerfile
    restart: unless-stopped
    cap_add:
      - SYS_ADMIN
    devices:
      - /dev/fuse:/dev/fuse
    security_opt:
      - apparmor:unconfined
    # No host port: architecture §2.2 — only Nginx is externally reachable.
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      SERVICE_NAME: runtime-manager
      STORAGE_BACKEND: ${STORAGE_BACKEND:-s3}
      LOCAL_STORAGE_BASE_DIR: ${LOCAL_STORAGE_BASE_DIR:-/data}
      # WORKSPACES_ROOT defaults to /data/workspaces (settings.workspaces_root);
      # in local mode runtime skips the rclone mount and reads directly from
      # ${LOCAL_STORAGE_BASE_DIR}/workspace instead.
      PUBLIC_BASE_URL: http://runtime
      # rclone config only used when STORAGE_BACKEND=s3 (mount skipped in local mode).
      # The remote spec ("s3:<workspace_bucket>") is derived in
      # common.storage.rclone_remote_spec(); no REMOTE_BUCKET env needed.
      RCLONE_CONFIG_S3_TYPE: s3
      RCLONE_CONFIG_S3_PROVIDER: Other
      RCLONE_CONFIG_S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY:-}
      RCLONE_CONFIG_S3_SECRET_ACCESS_KEY: ${S3_SECRET_KEY:-}
      RCLONE_CONFIG_S3_ENDPOINT: ${S3_ENDPOINT:-http://s3:9000}
      RCLONE_CONFIG_S3_ENV_AUTH: "false"
      RCLONE_CONFIG_S3_FORCE_PATH_STYLE: "true"
      RCLONE_CONFIG_S3_REGION: other
    depends_on:
      migrate:
        condition: service_completed_successfully
    volumes:
      - ./runtime:/app/runtime
      - ./data:/data
    healthcheck:
      test: ["CMD-SHELL", "grep -q ' /data/workspaces .* - fuse.rclone ' /proc/self/mountinfo && curl -fsS http://127.0.0.1:8000/api/v1/health >/dev/null"]
      interval: 10s
      timeout: 5s
      retries: 18
      start_period: 30s

  schedule:
    build:
      context: .
      dockerfile: schedule/Dockerfile
    restart: unless-stopped
   # No host port: architecture §2.2 — only Nginx is externally reachable.
   # No local-FS volume: schedule executes nodes via tempfile.TemporaryDirectory
    # under Python's default temp dir (cleaned per-run); artifacts live in S3.
    environment:
      DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required}
      SERVICE_NAME: schedule-executor
      SCHEDULE_EVENT_NAMESPACE: ${SCHEDULE_EVENT_NAMESPACE:-model-platform-local}
      BACKEND_API_URL: http://backend:8000
      STORAGE_BACKEND: ${STORAGE_BACKEND:-s3}
      LOCAL_STORAGE_BASE_DIR: ${LOCAL_STORAGE_BASE_DIR:-/data}
      S3_ENDPOINT: ${S3_ENDPOINT:-http://s3:9000}
      S3_ACCESS_KEY: ${S3_ACCESS_KEY:-}
      S3_SECRET_KEY: ${S3_SECRET_KEY:-}
      S3_WORKSPACE_BUCKET: ${S3_WORKSPACE_BUCKET:-workspaces}
      S3_VERSION_BUCKET: ${S3_VERSION_BUCKET:-versions}
      S3_RUN_LOG_BUCKET: ${S3_RUN_LOG_BUCKET:-run-logs}
      READINESS_TARGETS: ${MYSQL_HOST:?MYSQL_HOST is required}:${MYSQL_PORT:-3306},${S3_HOST:-s3}:${S3_PORT:-9000},backend:8000
    depends_on:
      backend:
        condition: service_healthy
    volumes:
      - ./schedule:/app/schedule
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8000/health/ready >/dev/null"]
      interval: 10s
      timeout: 5s
      retries: 18
      start_period: 20s