opencode-docker/docker-compose.yml at main · agent37-platform/opencode-docker · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
# Four ways to run OpenCode in a container:
#
#   docker compose run --rm opencode   # interactive TUI in the current directory
#   docker compose run --rm yolo       # same, behind the default-deny egress firewall
#   docker compose up -d serve         # headless HTTP server on 127.0.0.1:4096
#   docker compose up -d web           # the browser UI on 127.0.0.1:4096
#
# All OpenCode state (credentials in ~/.local/share/opencode/auth.json, sessions,
# config, cache) persists in the opencode-home volume: log in once, keep it
# across runs and rebuilds. Or export a provider key (see .env.example) and skip
# interactive login entirely.
#
# Mount a different project: WORKSPACE=~/code/myapp docker compose run --rm opencode

x-opencode: &opencode
  build: .
  image: opencode-docker
  volumes:
    - opencode-home:/home/opencode
    - ${WORKSPACE:-.}:/workspace
  environment:
    # Passed through only when set in your shell or .env
    - ANTHROPIC_API_KEY
    - OPENAI_API_KEY
    - OPENROUTER_API_KEY
    - GEMINI_API_KEY
    - OPENCODE_API_KEY

services:
  opencode:
    <<: *opencode
    stdin_open: true
    tty: true

  # Autonomous sessions, contained. OpenCode allows every tool by default, so the
  # container boundary plus the firewall (init-firewall.sh: model catalog,
  # providers, GitHub, npm) is what limits a bad run. Everything else is dropped.
  yolo:
    <<: *opencode
    stdin_open: true
    tty: true
    cap_add:
      - NET_ADMIN
    environment:
      - ANTHROPIC_API_KEY
      - OPENAI_API_KEY
      - OPENROUTER_API_KEY
      - GEMINI_API_KEY
      - OPENCODE_API_KEY
      - FIREWALL=1
      # Space-separated extra domains your project needs, e.g. "pypi.org crates.io"
      - FIREWALL_ALLOW_DOMAINS

  # Headless server: the HTTP API that the TUI, the desktop app, `opencode attach`
  # and `opencode run --attach` all speak. OPENCODE_SERVER_PASSWORD is mandatory
  # (the entrypoint refuses to start a network-bound server without one) because
  # the server has full tool access to /workspace.
  serve:
    <<: *opencode
    command: ["opencode", "serve", "--hostname", "0.0.0.0", "--port", "4096"]
    ports:
      - "127.0.0.1:${OPENCODE_PORT:-4096}:4096"
    environment:
      - ANTHROPIC_API_KEY
      - OPENAI_API_KEY
      - OPENROUTER_API_KEY
      - GEMINI_API_KEY
      - OPENCODE_API_KEY
      - OPENCODE_SERVER_PASSWORD
      - OPENCODE_SERVER_USERNAME=${OPENCODE_SERVER_USERNAME:-opencode}
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS -u \"$${OPENCODE_SERVER_USERNAME}:$${OPENCODE_SERVER_PASSWORD}\" http://127.0.0.1:4096/global/health"]
      interval: 30s
      timeout: 5s
      retries: 3
    restart: unless-stopped

  # Same server plus the web UI at http://127.0.0.1:4096. Put it behind
  # HTTPS (a reverse proxy or a tunnel) before exposing it beyond localhost.
  web:
    <<: *opencode
    command: ["opencode", "web", "--hostname", "0.0.0.0", "--port", "4096"]
    ports:
      - "127.0.0.1:${OPENCODE_PORT:-4096}:4096"
    environment:
      - ANTHROPIC_API_KEY
      - OPENAI_API_KEY
      - OPENROUTER_API_KEY
      - GEMINI_API_KEY
      - OPENCODE_API_KEY
      - OPENCODE_SERVER_PASSWORD
      - OPENCODE_SERVER_USERNAME=${OPENCODE_SERVER_USERNAME:-opencode}
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS -u \"$${OPENCODE_SERVER_USERNAME}:$${OPENCODE_SERVER_PASSWORD}\" http://127.0.0.1:4096/global/health"]
      interval: 30s
      timeout: 5s
      retries: 3
    restart: unless-stopped

volumes:
  opencode-home: