docker-compose.dev.yml

services:
  caddy:
    image: caddy:2.10.2-alpine
    restart: unless-stopped
    ports:
      - ${PUBLIC_APP_PORT}:${PUBLIC_APP_PORT}
    environment:
      - BASE_DOMAIN=${BASE_DOMAIN}
      - ADDRESS=${ADDRESS}
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile

  api:
    build:
      context: .
      dockerfile: Dockerfile
      target: development
    restart: unless-stopped
    ports:
      - ${API_PORT:-8000}:8000
    environment:
      # App
      LOG_LEVEL: ${LOG_LEVEL}
      TRACECAT__ALLOW_ORIGINS: ${TRACECAT__ALLOW_ORIGINS}
      TRACECAT__API_ROOT_PATH: ${TRACECAT__API_ROOT_PATH}
      TRACECAT__API_URL: ${TRACECAT__API_URL}
      TRACECAT__APP_ENV: ${TRACECAT__APP_ENV}
      TRACECAT__AUTH_ALLOWED_DOMAINS: ${TRACECAT__AUTH_ALLOWED_DOMAINS}
      TRACECAT__AUTH_MIN_PASSWORD_LENGTH: ${TRACECAT__AUTH_MIN_PASSWORD_LENGTH}
      TRACECAT__AUTH_TYPES: ${TRACECAT__AUTH_TYPES}
      TRACECAT__AUTH_SUPERADMIN_EMAIL: ${TRACECAT__AUTH_SUPERADMIN_EMAIL}
      TRACECAT__DEV_COOKIE_NAME: ${TRACECAT__DEV_COOKIE_NAME:-}
      TRACECAT__DB_ENCRYPTION_KEY: ${TRACECAT__DB_ENCRYPTION_KEY} # Sensitive
      TRACECAT__DB_SSLMODE: ${TRACECAT__DB_SSLMODE}
      TRACECAT__DB_URI: ${TRACECAT__DB_URI} # Sensitive
      TRACECAT__PUBLIC_API_URL: ${TRACECAT__PUBLIC_API_URL}
      TRACECAT__PUBLIC_APP_URL: ${TRACECAT__PUBLIC_APP_URL}
      TRACECAT__SERVICE_KEY: ${TRACECAT__SERVICE_KEY} # Sensitive
      TRACECAT__SIGNING_SECRET: ${TRACECAT__SIGNING_SECRET} # Sensitive
      OAUTH_CLIENT_ID: ${OAUTH_CLIENT_ID}
      OAUTH_CLIENT_SECRET: ${OAUTH_CLIENT_SECRET}
      OIDC_ISSUER: ${OIDC_ISSUER}
      OIDC_CLIENT_ID: ${OIDC_CLIENT_ID}
      OIDC_CLIENT_SECRET: ${OIDC_CLIENT_SECRET}
      OIDC_SCOPES: ${OIDC_SCOPES}
      USER_AUTH_SECRET: ${USER_AUTH_SECRET}
      TRACECAT__FEATURE_FLAGS: ${TRACECAT__FEATURE_FLAGS}
      TRACECAT__EE_MULTI_TENANT: ${TRACECAT__EE_MULTI_TENANT:-false}
      TRACECAT__CONTEXT_COMPRESSION_ENABLED: ${TRACECAT__CONTEXT_COMPRESSION_ENABLED:-false}
      TRACECAT__CONTEXT_COMPRESSION_THRESHOLD_KB: ${TRACECAT__CONTEXT_COMPRESSION_THRESHOLD_KB:-16}
      TRACECAT__RESULT_EXTERNALIZATION_ENABLED: ${TRACECAT__RESULT_EXTERNALIZATION_ENABLED}
      TRACECAT__COLLECTION_MANIFESTS_ENABLED: ${TRACECAT__COLLECTION_MANIFESTS_ENABLED}
      TRACECAT__RESULT_EXTERNALIZATION_THRESHOLD_BYTES: ${TRACECAT__RESULT_EXTERNALIZATION_THRESHOLD_BYTES}
      # SAML SSO
      SAML_IDP_METADATA_URL: ${SAML_IDP_METADATA_URL}
      # Temporal
      TEMPORAL__CLUSTER_URL: ${TEMPORAL__CLUSTER_URL}
      TEMPORAL__CLUSTER_QUEUE: ${TEMPORAL__CLUSTER_QUEUE}
      TEMPORAL__CLUSTER_NAMESPACE: ${TEMPORAL__CLUSTER_NAMESPACE}
      TEMPORAL__API_KEY: ${TEMPORAL__API_KEY}
      # Blob Storage
      TRACECAT__BLOB_STORAGE_ENDPOINT: http://minio:9000
      TRACECAT__BLOB_STORAGE_PRESIGNED_URL_ENDPOINT: ${PUBLIC_APP_URL}/s3
      TRACECAT__WORKFLOW_ARTIFACT_RETENTION_DAYS: ${TRACECAT__WORKFLOW_ARTIFACT_RETENTION_DAYS:-30}
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
      # Local registry
      TRACECAT__LOCAL_REPOSITORY_PATH: ${TRACECAT__LOCAL_REPOSITORY_PATH}
      TRACECAT__LOCAL_REPOSITORY_ENABLED: ${TRACECAT__LOCAL_REPOSITORY_ENABLED}
      # Redis
      REDIS_URL: ${REDIS_URL}

    volumes:
      - ./tracecat:/app/tracecat
      - ./packages:/app/packages
      - ./alembic:/app/alembic
      - ${TRACECAT__LOCAL_REPOSITORY_PATH}:/app/local_registry
    depends_on:
      migrations:
        condition: service_completed_successfully
      temporal:
        condition: service_healthy
      minio:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8000/ready"]
      interval: 5s
      timeout: 5s
      retries: 30
      start_period: 10s

  worker:
    build:
      context: .
      dockerfile: Dockerfile
      target: development
    restart: unless-stopped
    environment:
      LOG_LEVEL: ${LOG_LEVEL}
      TRACECAT__API_ROOT_PATH: ${TRACECAT__API_ROOT_PATH}
      TRACECAT__API_URL: ${TRACECAT__API_URL}
      TRACECAT__APP_ENV: ${TRACECAT__APP_ENV}
      TRACECAT__DB_ENCRYPTION_KEY: ${TRACECAT__DB_ENCRYPTION_KEY} # Sensitive
      TRACECAT__DB_SSLMODE: ${TRACECAT__DB_SSLMODE}
      TRACECAT__DB_URI: ${TRACECAT__DB_URI} # Sensitive
      TRACECAT__PUBLIC_API_URL: ${TRACECAT__PUBLIC_API_URL}
      TRACECAT__SERVICE_KEY: ${TRACECAT__SERVICE_KEY} # Sensitive
      TRACECAT__SIGNING_SECRET: ${TRACECAT__SIGNING_SECRET} # Sensitive
      TRACECAT__FEATURE_FLAGS: ${TRACECAT__FEATURE_FLAGS}
      TRACECAT__EE_MULTI_TENANT: ${TRACECAT__EE_MULTI_TENANT:-false}
      TRACECAT__CONTEXT_COMPRESSION_ENABLED: ${TRACECAT__CONTEXT_COMPRESSION_ENABLED:-false}
      TRACECAT__CONTEXT_COMPRESSION_THRESHOLD_KB: ${TRACECAT__CONTEXT_COMPRESSION_THRESHOLD_KB:-16}
      TRACECAT__RESULT_EXTERNALIZATION_ENABLED: ${TRACECAT__RESULT_EXTERNALIZATION_ENABLED}
      TRACECAT__COLLECTION_MANIFESTS_ENABLED: ${TRACECAT__COLLECTION_MANIFESTS_ENABLED}
      TRACECAT__RESULT_EXTERNALIZATION_THRESHOLD_BYTES: ${TRACECAT__RESULT_EXTERNALIZATION_THRESHOLD_BYTES}
      # Temporal
      TEMPORAL__CLUSTER_URL: ${TEMPORAL__CLUSTER_URL}
      TEMPORAL__CLUSTER_QUEUE: ${TEMPORAL__CLUSTER_QUEUE}
      TEMPORAL__CLUSTER_NAMESPACE: ${TEMPORAL__CLUSTER_NAMESPACE}
      TEMPORAL__API_KEY: ${TEMPORAL__API_KEY}
      # Local registry
      TRACECAT__LOCAL_REPOSITORY_PATH: ${TRACECAT__LOCAL_REPOSITORY_PATH}
      TRACECAT__LOCAL_REPOSITORY_ENABLED: ${TRACECAT__LOCAL_REPOSITORY_ENABLED}
      TRACECAT__EXECUTOR_CLIENT_TIMEOUT: ${TRACECAT__EXECUTOR_CLIENT_TIMEOUT:-300}
      # Sentry
      SENTRY_DSN: ${SENTRY_DSN:-}
      # Redis
      REDIS_URL: ${REDIS_URL}
      # Blob storage (for S3)
      TRACECAT__BLOB_STORAGE_ENDPOINT: ${TRACECAT__BLOB_STORAGE_ENDPOINT:-http://minio:9000}
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
    volumes:
      - ./tracecat:/app/tracecat
      - ./packages:/app/packages
      - ${TRACECAT__LOCAL_REPOSITORY_PATH}:/app/local_registry
    command: ["python", "-m", "tracecat.dsl.worker"]
    depends_on:
      migrations:
        condition: service_completed_successfully
      api:
        condition: service_started
      temporal:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy

  executor:
    build:
      context: .
      dockerfile: Dockerfile
      target: development
    restart: unless-stopped
    # Required for nsjail sandbox (when enabled)
    # cap_add:
    #   - SYS_ADMIN
    # security_opt:
    #   - seccomp:unconfined
    # devices:
    #   - /dev/net/tun:/dev/net/tun
    environment:
      # Common
      LOG_LEVEL: ${LOG_LEVEL}
      TRACECAT__APP_ENV: ${TRACECAT__APP_ENV}
      TRACECAT__DB_ENCRYPTION_KEY: ${TRACECAT__DB_ENCRYPTION_KEY} # Sensitive
      TRACECAT__DB_SSLMODE: ${TRACECAT__DB_SSLMODE}
      TRACECAT__DB_URI: ${TRACECAT__DB_URI} # Sensitive
      TRACECAT__SERVICE_KEY: ${TRACECAT__SERVICE_KEY} # Sensitive
      TRACECAT__SIGNING_SECRET: ${TRACECAT__SIGNING_SECRET} # Sensitive
      TRACECAT__FEATURE_FLAGS: ${TRACECAT__FEATURE_FLAGS}
      TRACECAT__EE_MULTI_TENANT: ${TRACECAT__EE_MULTI_TENANT:-false}
      TRACECAT__API_URL: ${TRACECAT__API_URL:-http://api:8000}
      # Compression (must match worker for codec compatibility)
      TRACECAT__CONTEXT_COMPRESSION_ENABLED: ${TRACECAT__CONTEXT_COMPRESSION_ENABLED:-false}
      TRACECAT__CONTEXT_COMPRESSION_THRESHOLD_KB: ${TRACECAT__CONTEXT_COMPRESSION_THRESHOLD_KB:-16}
      TRACECAT__RESULT_EXTERNALIZATION_ENABLED: ${TRACECAT__RESULT_EXTERNALIZATION_ENABLED}
      TRACECAT__COLLECTION_MANIFESTS_ENABLED: ${TRACECAT__COLLECTION_MANIFESTS_ENABLED}
      TRACECAT__RESULT_EXTERNALIZATION_THRESHOLD_BYTES: ${TRACECAT__RESULT_EXTERNALIZATION_THRESHOLD_BYTES}
      # Registry
      TRACECAT__UNSAFE_DISABLE_SM_MASKING: ${TRACECAT__UNSAFE_DISABLE_SM_MASKING:-false}
      # Local registry
      TRACECAT__LOCAL_REPOSITORY_PATH: ${TRACECAT__LOCAL_REPOSITORY_PATH}
      TRACECAT__LOCAL_REPOSITORY_ENABLED: ${TRACECAT__LOCAL_REPOSITORY_ENABLED}
      # Sandbox
      TRACECAT__DISABLE_NSJAIL: ${TRACECAT__DISABLE_NSJAIL:-true}
      TRACECAT__SANDBOX_NSJAIL_PATH: /usr/local/bin/nsjail
      TRACECAT__SANDBOX_ROOTFS_PATH: /var/lib/tracecat/sandbox-rootfs
      TRACECAT__SANDBOX_CACHE_DIR: /var/lib/tracecat/sandbox-cache
      # Temporal
      TEMPORAL__CLUSTER_URL: ${TEMPORAL__CLUSTER_URL}
      TEMPORAL__CLUSTER_NAMESPACE: ${TEMPORAL__CLUSTER_NAMESPACE}
      TEMPORAL__API_KEY: ${TEMPORAL__API_KEY}
      # Executor worker configuration
      TRACECAT__EXECUTOR_QUEUE: ${TRACECAT__EXECUTOR_QUEUE:-shared-action-queue}
      # Pool size auto-scales based on available CPUs if not set
      TRACECAT__EXECUTOR_WORKER_POOL_SIZE: ${TRACECAT__EXECUTOR_WORKER_POOL_SIZE:-}
      TRACECAT__EXECUTOR_BACKEND: ${TRACECAT__EXECUTOR_BACKEND:-direct}
      # Redis
      REDIS_URL: ${REDIS_URL}
      # Blob storage (for S3/MinIO wheel access)
      TRACECAT__BLOB_STORAGE_ENDPOINT: ${TRACECAT__BLOB_STORAGE_ENDPOINT:-http://minio:9000}
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
    volumes:
      - ./tracecat:/app/tracecat
      - ./packages:/app/packages
      - ${TRACECAT__LOCAL_REPOSITORY_PATH}:/app/local_registry
      - sandbox-cache:/var/lib/tracecat/sandbox-cache
    command: ["python", "-m", "tracecat.executor.worker"]
    depends_on:
      migrations:
        condition: service_completed_successfully
      temporal:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy

  agent-executor:
    build:
      context: .
      dockerfile: Dockerfile
      target: development
    restart: unless-stopped
    # Required for nsjail sandbox (agent runtime isolation)
    # cap_add:
    #   - SYS_ADMIN
    # security_opt:
    #   - seccomp:unconfined
    # # Required for pasta userspace networking (creates TAP device in sandbox netns)
    # devices:
    #   - /dev/net/tun:/dev/net/tun
    environment:
      # Common
      LOG_LEVEL: ${LOG_LEVEL}
      TRACECAT__APP_ENV: ${TRACECAT__APP_ENV}
      TRACECAT__DB_ENCRYPTION_KEY: ${TRACECAT__DB_ENCRYPTION_KEY} # Sensitive
      TRACECAT__DB_SSLMODE: ${TRACECAT__DB_SSLMODE}
      TRACECAT__DB_URI: ${TRACECAT__DB_URI} # Sensitive
      TRACECAT__SERVICE_KEY: ${TRACECAT__SERVICE_KEY} # Sensitive
      TRACECAT__SIGNING_SECRET: ${TRACECAT__SIGNING_SECRET} # Sensitive
      TRACECAT__FEATURE_FLAGS: ${TRACECAT__FEATURE_FLAGS}
      TRACECAT__EE_MULTI_TENANT: ${TRACECAT__EE_MULTI_TENANT:-false}
      TRACECAT__API_URL: ${TRACECAT__API_URL:-http://api:8000}
      # Compression (must match worker for codec compatibility)
      TRACECAT__CONTEXT_COMPRESSION_ENABLED: ${TRACECAT__CONTEXT_COMPRESSION_ENABLED:-false}
      TRACECAT__CONTEXT_COMPRESSION_THRESHOLD_KB: ${TRACECAT__CONTEXT_COMPRESSION_THRESHOLD_KB:-16}
      TRACECAT__RESULT_EXTERNALIZATION_ENABLED: ${TRACECAT__RESULT_EXTERNALIZATION_ENABLED}
      TRACECAT__COLLECTION_MANIFESTS_ENABLED: ${TRACECAT__COLLECTION_MANIFESTS_ENABLED}
      TRACECAT__RESULT_EXTERNALIZATION_THRESHOLD_BYTES: ${TRACECAT__RESULT_EXTERNALIZATION_THRESHOLD_BYTES}
      # Registry
      TRACECAT__UNSAFE_DISABLE_SM_MASKING: ${TRACECAT__UNSAFE_DISABLE_SM_MASKING:-false}
      # Local registry
      TRACECAT__LOCAL_REPOSITORY_PATH: ${TRACECAT__LOCAL_REPOSITORY_PATH}
      TRACECAT__LOCAL_REPOSITORY_ENABLED: ${TRACECAT__LOCAL_REPOSITORY_ENABLED}
      # Sandbox
      TRACECAT__EXECUTOR_BACKEND: ${TRACECAT__EXECUTOR_BACKEND:-direct}
      TRACECAT__DISABLE_NSJAIL: ${TRACECAT__DISABLE_NSJAIL:-true}
      TRACECAT__SANDBOX_NSJAIL_PATH: /usr/local/bin/nsjail
      TRACECAT__SANDBOX_ROOTFS_PATH: /var/lib/tracecat/sandbox-rootfs
      TRACECAT__SANDBOX_CACHE_DIR: /var/lib/tracecat/sandbox-cache
      # Temporal
      TEMPORAL__CLUSTER_URL: ${TEMPORAL__CLUSTER_URL}
      TEMPORAL__CLUSTER_NAMESPACE: ${TEMPORAL__CLUSTER_NAMESPACE}
      TEMPORAL__API_KEY: ${TEMPORAL__API_KEY}
      # Agent Worker configuration
      TRACECAT__AGENT_QUEUE: ${TRACECAT__AGENT_QUEUE:-shared-agent-queue}
      # Pool size auto-scales based on available CPUs if not set
      TRACECAT__EXECUTOR_WORKER_POOL_SIZE: ${TRACECAT__EXECUTOR_WORKER_POOL_SIZE:-}
      # Redis
      REDIS_URL: ${REDIS_URL}
      # Blob storage (for S3/MinIO tarball access)
      TRACECAT__BLOB_STORAGE_ENDPOINT: ${TRACECAT__BLOB_STORAGE_ENDPOINT:-http://minio:9000}
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
    volumes:
      - ./tracecat:/app/tracecat
      - ./packages:/app/packages
      - ${TRACECAT__LOCAL_REPOSITORY_PATH}:/app/local_registry
      - sandbox-cache:/var/lib/tracecat/sandbox-cache
    command: ["python", "-m", "tracecat.agent.worker"]
    depends_on:
      migrations:
        condition: service_completed_successfully
      api:
        condition: service_started
      temporal:
        condition: service_healthy
      redis:
        condition: service_healthy
      minio:
        condition: service_healthy

  ui:
    # image: ghcr.io/tracecathq/tracecat-ui:${TRACECAT__IMAGE_TAG:-0.36.6}
    # container_name: ui
    build:
      context: ./frontend
      dockerfile: Dockerfile
      args:
        NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
        NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL}
        NEXT_SERVER_API_URL: ${NEXT_SERVER_API_URL}
        NODE_ENV: ${NODE_ENV}
    volumes:
      - ./frontend/src:/app/src
      - ./frontend/.next:/app/.next
      - ./frontend/node_modules:/app/node_modules
    restart: unless-stopped
    ports:
      - ${UI_PORT:-3000}:3000
    environment:
      NEXT_PUBLIC_API_URL: ${NEXT_PUBLIC_API_URL}
      NEXT_PUBLIC_APP_ENV: ${NEXT_PUBLIC_APP_ENV}
      NEXT_PUBLIC_APP_URL: ${NEXT_PUBLIC_APP_URL}
      NEXT_PUBLIC_AUTH_TYPES: ${TRACECAT__AUTH_TYPES}
      NEXT_SERVER_API_URL: ${NEXT_SERVER_API_URL}
      NODE_ENV: ${NODE_ENV}
      TRACECAT__SERVICE_KEY: ${TRACECAT__SERVICE_KEY}
    attach: false
    depends_on:
      - api

  postgres_db:
    image: postgres:16
    restart: unless-stopped
    ports:
      - ${PG_PORT:-5432}:5432
    shm_size: 128mb
    environment:
      POSTGRES_USER: ${TRACECAT__POSTGRES_USER}
      POSTGRES_PASSWORD: ${TRACECAT__POSTGRES_PASSWORD}
    volumes:
      - core-db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d postgres"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 5s

  migrations:
    build:
      context: .
      dockerfile: Dockerfile
      target: development
    restart: "no"
    environment:
      LOG_LEVEL: ${LOG_LEVEL}
      TRACECAT__DB_URI: ${TRACECAT__DB_URI}
      TRACECAT__DB_SSLMODE: ${TRACECAT__DB_SSLMODE}
    volumes:
      - ./tracecat:/app/tracecat
      - ./packages:/app/packages
      - ./alembic:/app/alembic
    command: ["python3", "-m", "alembic", "upgrade", "head"]
    depends_on:
      postgres_db:
        condition: service_healthy

  temporal_postgres_db:
    image: postgres:13
    restart: unless-stopped
    environment:
      POSTGRES_USER: ${TEMPORAL__POSTGRES_USER}
      POSTGRES_PASSWORD: ${TEMPORAL__POSTGRES_PASSWORD}
    volumes:
      - temporal-db:/var/lib/postgresql/data

  temporal:
    image: temporalio/auto-setup:${TEMPORAL__VERSION:-1.27.1}
    restart: unless-stopped
    ports:
      - ${TEMPORAL_PORT:-7233}:7233
    environment:
      - DB=postgres12
      - DB_PORT=5432
      - POSTGRES_USER=${TEMPORAL__POSTGRES_USER}
      - POSTGRES_PWD=${TEMPORAL__POSTGRES_PASSWORD}
      - POSTGRES_SEEDS=temporal_postgres_db
      - LOG_LEVEL=warn
    healthcheck:
      test: ["CMD", "tctl", "--address", "temporal:7233", "cluster", "health"]
      interval: 5s
      timeout: 10s
      retries: 30
    depends_on:
      - temporal_postgres_db

    attach: false

  temporal_ui:
    image: temporalio/ui:${TEMPORAL__UI_VERSION:-latest}
    ports:
      - ${TEMPORAL_UI_PORT:-8081}:8081
    environment:
      - TEMPORAL_ADDRESS=temporal:7233
      - TEMPORAL_CORS_ORIGINS=http://localhost:8081
    depends_on:
      - temporal
    attach: false

  minio:
    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
    restart: unless-stopped
    ports:
      - ${MINIO_PORT:-9000}:9000
      - ${MINIO_CONSOLE_PORT:-9001}:9001
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
    volumes:
      - minio-data:/data
    command: server /data --console-address ":9001"
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 5s
      timeout: 5s
      retries: 5
    attach: false

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    ports:
      - ${REDIS_PORT_HOST:-6379}:6379
    volumes:
      - redis-data:/data
    command: redis-server --appendonly yes
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 5
    attach: false

volumes:
  core-db:
  temporal-db:
  containers:
  minio-data:
  redis-data:
  sandbox-cache: