openclaw/docker-compose.yml at main · coollabsio/openclaw · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
services:
  openclaw:
    image: coollabsio/openclaw:latest
    ports:
      - "${PORT:-8080}:${PORT:-8080}"
    environment:
      # Provider (at least one required)
      #- ANTHROPIC_API_KEY=sk-ant-...
      - OPENCODE_API_KEY=${OPENCODE_API_KEY}
      - OPENCLAW_PRIMARY_MODEL=opencode/kimi-k2.5
      # Auth
      - AUTH_USERNAME=${AUTH_USERNAME:-admin}
      - AUTH_PASSWORD=${AUTH_PASSWORD}
      - OPENCLAW_GATEWAY_TOKEN=${OPENCLAW_GATEWAY_TOKEN}
      # Chat history is /data/.openclaw/agents/<agentId>/agent/openclaw-agent.sqlite.
      # HOME must be /data. The image default /root is outside this volume.
      - HOME=/data
      - OPENCLAW_HOME=/data
      - OPENCLAW_STATE_DIR=/data/.openclaw
      - OPENCLAW_WORKSPACE_DIR=/data/workspace
      # Browser sidecar. CDP is the image proxy on 9223 (Chromium stays on
      # 127.0.0.1:9222). configure.js allowlists hostname "browser" for SSRF.
      # Other private addresses stay blocked; do not set dangerouslyAllowPrivateNetwork.
      - BROWSER_CDP_URL=http://browser:9223
      - BROWSER_DEFAULT_PROFILE=openclaw
      - BROWSER_EVALUATE_ENABLED=true
      # CORS / Allowed Origins (optional)
      # - OPENCLAW_ALLOWED_ORIGINS=http://localhost:5173,https://app.example.com
      # Dot-notation config (optional - for settings not covered by dedicated env vars)
      # - OPENCLAW__channels__telegram__textChunkLimit=3500
      # JSON config via env var (optional - partial or full config as JSON)
      # - OPENCLAW_CONFIG_JSON={"agents":{"defaults":{"model":{"fallback":"gemini/gemini-3-pro"}}}}
      # Hooks (optional)
      # - HOOKS_ENABLED=true
      # - HOOKS_TOKEN=my-hook-secret
    volumes:
      # Required. Covers config, credentials, workspace, and chat history
      # (/data/.openclaw/agents/<agentId>/agent/openclaw-agent.sqlite).
      # `docker compose down` keeps this volume. `down -v` deletes it.
      - openclaw-data:/data
      # Optional agent sandbox. Leave this commented unless you opt in.
      # Mounting the socket gives this container root on the host.
      # See README "Agent sandbox".
      # - /var/run/docker.sock:/var/run/docker.sock
      # Optional: custom JSON config for complex settings (groups, plugins, etc.)
      # - ./my-openclaw.json:/app/config/openclaw.json
    depends_on:
      browser:
        condition: service_healthy
    restart: unless-stopped

  browser:
    image: coollabsio/openclaw-browser:latest
    # Desktop UI is proxied through openclaw at /browser/ (container port 3000).
    # CDP is http://browser:9223 on this compose network only. Chromium itself
    # listens on 127.0.0.1:9222; the image proxies that to 0.0.0.0:9223.
    # Do not publish 9222 or 9223 — DevTools is full browser control.
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      # Chrome 111+ rejects a CDP websocket whose Origin is not allowed.
      # The image proxy also clears Origin on port 9223.
      - CHROME_CLI=--remote-debugging-port=9222 --remote-allow-origins=*
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:9223/json/version"]
      interval: 5s
      timeout: 3s
      retries: 20
      start_period: 20s
    volumes:
      - browser-data:/config
    shm_size: 2g
    restart: unless-stopped

volumes:
  openclaw-data:
  browser-data: