pi-pocket/docker-compose.yml at main · TannerMidd/pi-pocket · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
# Pi Pocket in Docker or Podman.
#
#   cp .env.example .env       # optional: change ports and external folders
#   docker compose up -d --build
#   podman compose up -d --build
#
# The folders under ./data are yours: edit extensions and themes there, keep
# Pi's sign-ins in ./data/pi, and put the projects Pi works on in ./data/workspace.
# Set the variables in .env (or the shell) to use folders anywhere else on the host.
#
# Sign in at the link the launcher prints:
#   docker compose logs pi-pocket | grep '/login?token='
#   podman logs pi-pocket | grep '/login?token='
# and change its address (the container's) to the host's, such as localhost.

name: pi-pocket

services:
    pi-pocket:
        build:
            context: .
            dockerfile: docker/Dockerfile
        image: pi-pocket:local
        container_name: pi-pocket
        restart: unless-stopped
        stop_grace_period: 30s

        ports:
            - "${PI_POCKET_BIND:-0.0.0.0}:${PI_POCKET_PORT:-8787}:${PI_POCKET_PORT:-8787}"

        environment:
            HOME: /home/node
            PI_POCKET_ACCESS: ${PI_POCKET_ACCESS:-lan}
            PI_POCKET_PORT: ${PI_POCKET_PORT:-8787}
            # Chromium runs without its sandbox inside a container; /dev/shm is small there.
            PI_POCKET_BROWSER: /usr/bin/chromium
            PI_POCKET_BROWSER_ARGS: ${PI_POCKET_BROWSER_ARGS:---no-sandbox --disable-dev-shm-usage}
            # Uncomment to make Lancet Guard unavailable:
            # PI_POCKET_GUARD: off
            #
            # Provider keys can go here instead of signing in from the app, for example:
            # ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
            # OPENAI_API_KEY: ${OPENAI_API_KEY:-}

        volumes:
            # Pi Pocket's database, people, settings, uploads, worktrees, and themes.
            - ${PI_POCKET_DATA:-./data}:/data
            # The owner's drop-in extensions, loaded from this external folder.
            - ${PI_POCKET_EXTENSIONS:-./data/extensions}:/data/extensions
            # The owner's themes, loaded from this external folder.
            - ${PI_POCKET_THEMES:-./data/themes}:/data/themes
            # Pi's own folder: auth.json, settings.json, AGENTS.md, skills, prompts,
            # trust.json, and sessions. Keeping it here lets a fresh database reuse the
            # same sign-ins, and lets a Pi CLI on the host share the folder.
            - ${PI_POCKET_PI_DIR:-./data/pi}:/home/node/.pi
            # Projects Pi works on. This is also where new sessions start.
            - ${PI_POCKET_WORKSPACE:-./data/workspace}:/workspace

        working_dir: /workspace

        # Compose runs the container as root. Rootless Podman maps that to your own
        # host user, which is what makes the bind-mounted folders writable. With
        # Docker you can run as your user instead, if the folders are owned by it:
        #
        # user: "1000:1000"

        # No process in the container gains privileges it did not start with (setuid,
        # file capabilities). Pi's commands and the unsandboxed Chromium run with less.
        security_opt:
            - no-new-privileges:true

        healthcheck:
            test:
                [
                    "CMD",
                    "node",
                    "-e",
                    "fetch('http://127.0.0.1:'+(process.env.PI_POCKET_PORT||8787)+'/style.css').then(r=>process.exit(r.ok?0:1),()=>process.exit(1))",
                ]
            interval: 30s
            timeout: 5s
            start_period: 20s
            retries: 3