docker-compose.yaml

# Full-stack deployment: Airflow (LocalExecutor + postgres) + MLflow + MinIO.
# Derived from the official Airflow 3.2.2 compose file, stripped of
# Celery/Redis/Flower (LocalExecutor needs neither broker nor workers), and
# extended with the tracking + storage services and DockerOperator wiring.
#
# Env contract lives in .env (copy from .env.example). Notable:
#   HOST_PROJECT_DIR  absolute HOST path of this repo — DockerOperator bind
#                     mounts need host paths even though Airflow itself runs
#                     in a container (PLAN §8 W3)
#   DOCKER_GID        gid owning /var/run/docker.sock on the host (Linux:
#                     `getent group docker | cut -d: -f3`; macOS: leave 0)
---
x-airflow-common:
  &airflow-common
  image: ${AIRFLOW_IMAGE_NAME:-apache/airflow:3.2.2}
  env_file:
    - ${ENV_FILE_PATH:-.env}
  environment:
    &airflow-common-env
    AIRFLOW__CORE__EXECUTOR: LocalExecutor
    AIRFLOW__CORE__AUTH_MANAGER: airflow.providers.fab.auth_manager.fab_auth_manager.FabAuthManager
    AIRFLOW__DATABASE__SQL_ALCHEMY_CONN: postgresql+psycopg2://airflow:airflow@postgres/airflow
    AIRFLOW__CORE__FERNET_KEY: ${FERNET_KEY:-}
    AIRFLOW__CORE__DAGS_ARE_PAUSED_AT_CREATION: 'true'
    AIRFLOW__CORE__LOAD_EXAMPLES: 'false'
    AIRFLOW__CORE__EXECUTION_API_SERVER_URL: 'http://airflow-apiserver:8080/execution/'
    AIRFLOW__API_AUTH__JWT_SECRET: ${AIRFLOW__API_AUTH__JWT_SECRET:-airflow_jwt_secret}
    AIRFLOW__API_AUTH__JWT_ISSUER: ${AIRFLOW__API_AUTH__JWT_ISSUER:-airflow}
    AIRFLOW__SCHEDULER__ENABLE_HEALTH_CHECK: 'true'
    _PIP_ADDITIONAL_REQUIREMENTS: ${_PIP_ADDITIONAL_REQUIREMENTS:-}
    AIRFLOW_CONFIG: '/opt/airflow/config/airflow.cfg'
    # --- pipeline execution wiring (consumed by dags/evaluate_agent.py) ---
    EXECUTION_MODE: docker
    PIPELINE_PYTHON: python          # prepare-run is stdlib-only; no uv here
    TASK_IMAGE: ${TASK_IMAGE:-coding-agent-eval-harness:latest}
    TASK_NETWORK_MODE: coding-agent-eval-harness_default
    # :? = fail at compose-up with a clear message instead of mounting a
    # phantom path deep inside a paid run (PLAN §8 W3).
    HOST_PROJECT_DIR: ${HOST_PROJECT_DIR:?Set HOST_PROJECT_DIR in .env to the absolute HOST path of this repo}
    HOST_RUNS_DIR: ${HOST_RUNS_DIR:-}
    # In-network service endpoints override the laptop-oriented values that
    # env_file may carry (environment: wins over env_file).
    MLFLOW_TRACKING_URI: http://mlflow:5000
    AWS_ENDPOINT_URL: http://minio:9000
  volumes:
    - ${AIRFLOW_PROJ_DIR:-.}/dags:/opt/airflow/dags
    - ${AIRFLOW_PROJ_DIR:-.}/logs:/opt/airflow/logs
    - ${AIRFLOW_PROJ_DIR:-.}/config:/opt/airflow/config
    - ${AIRFLOW_PROJ_DIR:-.}/plugins:/opt/airflow/plugins
    # the pipeline package (prepare-run runs on the container's python) and
    # the run-artifact tree, shared with DockerOperator task containers:
    - ${AIRFLOW_PROJ_DIR:-.}/pipeline:/opt/airflow/pipeline
    - ${AIRFLOW_PROJ_DIR:-.}/runs:/opt/airflow/runs
    # DockerOperator talks to the host daemon; task containers are siblings.
    - /var/run/docker.sock:/var/run/docker.sock
  user: "${AIRFLOW_UID:-50000}:0"
  group_add:
    # Required so DockerOperator can use the mounted socket. macOS: 0.
    # Linux: the docker group's gid — `getent group docker | cut -d: -f3`.
    - "${DOCKER_GID:?Set DOCKER_GID in .env — macOS 0, Linux the docker group gid}"
  depends_on:
    &airflow-common-depends-on
    postgres:
      condition: service_healthy

services:
  postgres:
    image: postgres:16
    environment:
      POSTGRES_USER: airflow
      POSTGRES_PASSWORD: airflow
      POSTGRES_DB: airflow
    volumes:
      - postgres-db-volume:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "airflow"]
      interval: 10s
      retries: 5
      start_period: 5s
    restart: always

  airflow-apiserver:
    <<: *airflow-common
    command: api-server
    ports:
      - "8080:8080"
    healthcheck:
      test: ["CMD", "curl", "--fail", "http://localhost:8080/api/v2/monitor/health"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s
    restart: always
    depends_on:
      <<: *airflow-common-depends-on
      airflow-init:
        condition: service_completed_successfully

  airflow-scheduler:
    <<: *airflow-common
    command: scheduler
    healthcheck:
      test: ["CMD", "curl", "--fail", "http://localhost:8974/health"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s
    restart: always
    depends_on:
      <<: *airflow-common-depends-on
      airflow-init:
        condition: service_completed_successfully

  airflow-dag-processor:
    <<: *airflow-common
    command: dag-processor
    healthcheck:
      test: ["CMD-SHELL", 'airflow jobs check --job-type DagProcessorJob --hostname "$${HOSTNAME}"']
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s
    restart: always
    depends_on:
      <<: *airflow-common-depends-on
      airflow-init:
        condition: service_completed_successfully

  airflow-triggerer:
    <<: *airflow-common
    command: triggerer
    healthcheck:
      test: ["CMD-SHELL", 'airflow jobs check --job-type TriggererJob --hostname "$${HOSTNAME}"']
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 30s
    restart: always
    depends_on:
      <<: *airflow-common-depends-on
      airflow-init:
        condition: service_completed_successfully

  airflow-init:
    <<: *airflow-common
    entrypoint: /bin/bash
    command:
      - -c
      - |
        mkdir -v -p /opt/airflow/{logs,dags,plugins,config,runs}
        /entrypoint airflow version
        /entrypoint airflow config list >/dev/null
        chown -R "${AIRFLOW_UID:-50000}:0" /opt/airflow/logs /opt/airflow/runs
        echo "airflow-init done"
    environment:
      <<: *airflow-common-env
      _AIRFLOW_DB_MIGRATE: 'true'
      _AIRFLOW_WWW_USER_CREATE: 'true'
      _AIRFLOW_WWW_USER_USERNAME: ${_AIRFLOW_WWW_USER_USERNAME:-airflow}
      _AIRFLOW_WWW_USER_PASSWORD: ${_AIRFLOW_WWW_USER_PASSWORD:-airflow}
      _PIP_ADDITIONAL_REQUIREMENTS: ''
    user: "0:0"

  airflow-cli:
    <<: *airflow-common
    profiles:
      - debug
    environment:
      <<: *airflow-common-env
      CONNECTION_CHECK_MAX_COUNT: "0"
    command:
      - bash
      - -c
      - airflow
    depends_on:
      <<: *airflow-common-depends-on

  mlflow:
    image: ${MLFLOW_IMAGE:-ghcr.io/mlflow/mlflow:v3.14.0}
    command: >
      mlflow server --host 0.0.0.0 --port 5000
      --backend-store-uri sqlite:////mlflow/mlflow.db
      --artifacts-destination /mlflow/artifacts
    environment:
      # MLflow 3.x rejects unknown Host headers (DNS-rebinding protection);
      # in-network clients arrive as "mlflow:5000", so allow it explicitly.
      MLFLOW_SERVER_ALLOWED_HOSTS: "mlflow:5000,mlflow,localhost:*,127.0.0.1:*"
    ports:
      # macOS: AirPlay Receiver squats on host port 5000 — override MLFLOW_PORT.
      - "${MLFLOW_PORT:-5000}:5000"
    volumes:
      - mlflow-data:/mlflow
    healthcheck:
      test: ["CMD-SHELL", "python -c \"import urllib.request; urllib.request.urlopen('http://localhost:5000/health')\""]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 15s
    restart: always

  minio:
    image: quay.io/minio/minio
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${AWS_ACCESS_KEY_ID:-minioadmin}
      MINIO_ROOT_PASSWORD: ${AWS_SECRET_ACCESS_KEY:-minioadmin}
    ports:
      - "9000:9000"
      - "9001:9001"
    volumes:
      - minio-data:/data
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    restart: always

  minio-init:
    image: quay.io/minio/mc
    depends_on:
      minio:
        condition: service_healthy
    entrypoint: >
      /bin/sh -c "
      mc alias set local http://minio:9000 $${MINIO_ROOT_USER} $${MINIO_ROOT_PASSWORD} &&
      mc mb --ignore-existing local/$${RUNS_BUCKET}
      "
    environment:
      MINIO_ROOT_USER: ${AWS_ACCESS_KEY_ID:-minioadmin}
      MINIO_ROOT_PASSWORD: ${AWS_SECRET_ACCESS_KEY:-minioadmin}
      RUNS_BUCKET: ${RUNS_BUCKET:-runs}

networks:
  default:
    # Pinned so TASK_NETWORK_MODE (DockerOperator containers joining this
    # network to resolve http://mlflow:5000 / http://minio:9000) never drifts
    # with the compose project name.
    name: coding-agent-eval-harness_default

volumes:
  postgres-db-volume:
  mlflow-data:
  minio-data: