docker-compose.yml

services:
  openclaw-gateway:
    image: ${OPENCLAW_IMAGE:-openclaw:local}
    environment:
      HOME: /home/node
      TERM: xterm-256color
      OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN:-}
      OPENCLAW_ALLOW_INSECURE_PRIVATE_WS: ${OPENCLAW_ALLOW_INSECURE_PRIVATE_WS:-}
      CLAUDE_AI_SESSION_KEY: ${CLAUDE_AI_SESSION_KEY:-}
      CLAUDE_WEB_SESSION_KEY: ${CLAUDE_WEB_SESSION_KEY:-}
      CLAUDE_WEB_COOKIE: ${CLAUDE_WEB_COOKIE:-}
    volumes:
      - ${OPENCLAW_CONFIG_DIR}:/home/node/.openclaw
      - ${OPENCLAW_WORKSPACE_DIR}:/home/node/.openclaw/workspace
      ## Uncomment the lines below to enable sandbox isolation
      ## (agents.defaults.sandbox). Requires Docker CLI in the image
      ## (build with --build-arg OPENCLAW_INSTALL_DOCKER_CLI=1) or use
      ## docker-setup.sh with OPENCLAW_SANDBOX=1 for automated setup.
      ## Set DOCKER_GID to the host's docker group GID (run: stat -c '%g' /var/run/docker.sock).
      # - /var/run/docker.sock:/var/run/docker.sock
    # group_add:
    #   - "${DOCKER_GID:-999}"
    ports:
      - "${OPENCLAW_GATEWAY_PORT:-18789}:18789"
      - "${OPENCLAW_BRIDGE_PORT:-18790}:18790"
    init: true
    restart: unless-stopped
    command:
      [
        "node",
        "dist/index.js",
        "gateway",
        "--bind",
        "${OPENCLAW_GATEWAY_BIND:-lan}",
        "--port",
        "18789",
      ]
    healthcheck:
      test:
        [
          "CMD",
          "node",
          "-e",
          "fetch('http://127.0.0.1:18789/healthz').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
        ]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s

  openclaw-cli:
    image: ${OPENCLAW_IMAGE:-openclaw:local}
    network_mode: "service:openclaw-gateway"
    cap_drop:
      - NET_RAW
      - NET_ADMIN
    security_opt:
      - no-new-privileges:true
    environment:
      HOME: /home/node
      TERM: xterm-256color
      OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN:-}
      OPENCLAW_ALLOW_INSECURE_PRIVATE_WS: ${OPENCLAW_ALLOW_INSECURE_PRIVATE_WS:-}
      BROWSER: echo
      CLAUDE_AI_SESSION_KEY: ${CLAUDE_AI_SESSION_KEY:-}
      CLAUDE_WEB_SESSION_KEY: ${CLAUDE_WEB_SESSION_KEY:-}
      CLAUDE_WEB_COOKIE: ${CLAUDE_WEB_COOKIE:-}
    volumes:
      - ${OPENCLAW_CONFIG_DIR}:/home/node/.openclaw
      - ${OPENCLAW_WORKSPACE_DIR}:/home/node/.openclaw/workspace
    stdin_open: true
    tty: true
    init: true
    entrypoint: ["node", "dist/index.js"]
    depends_on:
      - openclaw-gateway

  # ─────────────────────────────────────────────────────────
  # Oracle FreePDB (local container – used with ORACLE_MODE=freepdb)
  # Skip this service when using ADB cloud mode.
  # ─────────────────────────────────────────────────────────
  oracle-freepdb:
    image: container-registry.oracle.com/database/free:latest
    container_name: oraclaw-oracle
    profiles: ["freepdb"]
    environment:
      - ORACLE_PWD=${ORACLE_PASSWORD:-OracLaw2024}
      - ORACLE_CHARACTERSET=AL32UTF8
    ports:
      - "1521:1521"
    volumes:
      - oracle-data:/opt/oracle/oradata
    healthcheck:
      test:
        [
          "CMD",
          "sqlplus",
          "-L",
          "sys/${ORACLE_PASSWORD:-OracLaw2024}@//localhost:1521/FREEPDB1 as sysdba",
          "@/dev/null",
        ]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 120s
    restart: unless-stopped

  # ─────────────────────────────────────────────────────────
  # OracLaw sidecar – FreePDB mode (local container)
  # Usage: docker compose --profile freepdb up oracle-freepdb oraclaw-service
  # ─────────────────────────────────────────────────────────
  oraclaw-service:
    build:
      context: ./oraclaw-service
      dockerfile: Dockerfile
    container_name: oraclaw-service
    profiles: ["freepdb"]
    ports:
      - "${ORACLAW_SERVICE_PORT:-8100}:8100"
    environment:
      - ORACLE_MODE=freepdb
      - ORACLE_USER=${ORACLE_USER:-oraclaw}
      - ORACLE_PASSWORD=${ORACLE_PASSWORD:-OracLaw2024}
      - ORACLE_HOST=oracle-freepdb
      - ORACLE_PORT=1521
      - ORACLE_SERVICE=FREEPDB1
      - ORACLAW_SERVICE_PORT=8100
      - ORACLAW_SERVICE_TOKEN=${ORACLAW_SERVICE_TOKEN:-}
      - AUTO_INIT=true
    depends_on:
      oracle-freepdb:
        condition: service_healthy
    restart: unless-stopped

  # ─────────────────────────────────────────────────────────
  # OracLaw sidecar – ADB cloud mode (wallet-less TLS)
  # Usage: docker compose --profile adb up oraclaw-service-adb
  # ─────────────────────────────────────────────────────────
  oraclaw-service-adb:
    build:
      context: ./oraclaw-service
      dockerfile: Dockerfile
    container_name: oraclaw-service-adb
    profiles: ["adb"]
    ports:
      - "${ORACLAW_SERVICE_PORT:-8100}:8100"
    environment:
      - ORACLE_MODE=adb
      - ORACLE_USER=${ORACLE_USER:-ADMIN}
      - ORACLE_PASSWORD=${ORACLE_PASSWORD}
      - ORACLE_DSN=${ORACLE_DSN}
      - ORACLE_WALLET_PATH=${ORACLE_WALLET_PATH:-}
      - ORACLE_WALLET_PASSWORD=${ORACLE_WALLET_PASSWORD:-}
      - ORACLE_POOL_MIN=${ORACLE_POOL_MIN:-2}
      - ORACLE_POOL_MAX=${ORACLE_POOL_MAX:-10}
      - ORACLAW_SERVICE_PORT=8100
      - ORACLAW_SERVICE_TOKEN=${ORACLAW_SERVICE_TOKEN:-}
      - AUTO_INIT=true
    restart: unless-stopped

volumes:
  oracle-data: