compose.yml

services:
  air-friends:
    container_name: air-friends
    image: ghcr.io/jim60105/air-friends:latest
    build:
      context: .
      dockerfile: Containerfile
      target: final
      args:
        - NODE_ENV=development
    # Restricted baseline mirroring the OpenShift `restricted-v2` SCC (non-root UID, no
    # privilege escalation, all capabilities dropped), so the F14 egress posture and env
    # filtering are exercised the same way locally as in production. The default F14 egress
    # proxy needs no namespace privilege and works here as-is.
    #
    # NOTE on F12 filesystem confinement (`AGENT_SANDBOX_FILESYSTEM_CONFINEMENT`): it is OFF by
    # default and CANNOT be validated under rootless podman — rootless podman is itself a user
    # namespace, and bwrap mounting a fresh /proc inside a second nested userns fails with
    # "Can't mount proc … Permission denied" (adding SYS_ADMIN does not help; the constraint is
    # userns nesting, not capabilities). Verify confinement against your real (non-nested)
    # runtime with `scripts/probe-sandbox-caps.sh` before enabling it there.
    user: "1000:0"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    environment:
      - TZ=Asia/Taipei
    env_file:
      - .env
    volumes:
      - data:/app/data:Z  # Contains workspaces/ and agent-workspace/
      # - ./config.yaml:/app/config.yaml:ro,Z
      # Mount individual prompt files (optional, comment out to use defaults)
      # Only the files you mount will be overridden; others keep their container defaults.
      # - ./prompts/system_reply.md:/app/prompts/system_reply.md:ro,Z
      # - ./prompts/character_name.md:/app/prompts/character_name.md:ro,Z
      # - ./prompts/character_info.md:/app/prompts/character_info.md:ro,Z
      # - ./prompts/character_personality.md:/app/prompts/character_personality.md:ro,Z
      # - ./prompts/character_speaking_style.md:/app/prompts/character_speaking_style.md:ro,Z
      # - ./prompts/character_reference_terms.md:/app/prompts/character_reference_terms.md:ro,Z
      # - ./prompts/agent_workspace.md:/app/prompts/agent_workspace.md:ro,Z
      # - ./prompts/browser_automation.md:/app/prompts/browser_automation.md:ro,Z
      # - ./prompts/system_prompt_override.md:/app/prompts/system_prompt_override.md:ro,Z
      # - ./prompts/system_self_research.md:/app/prompts/system_self_research.md:ro,Z
      # - ./prompts/system_memory_maintenance.md:/app/prompts/system_memory_maintenance.md:ro,Z
      # - ./prompts/system_spontaneous.md:/app/prompts/system_spontaneous.md:ro,Z

volumes:
  data: