version: "3.8"

services:
  dockerproxy:
    image: ghcr.io/tecnativa/docker-socket-proxy:latest
    container_name: openclaw-dockerproxy
    restart: unless-stopped
    privileged: true
    environment:
      PING: 1
      VERSION: 1
      INFO: 1
      POST: 1
      CONTAINERS: 1
      IMAGES: 1
      NETWORKS: 1
      VOLUMES: 1
      EXEC: 1
      BUILD: 1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    read_only: true
    tmpfs:
      - /run
      - /tmp
    networks:
      - openclaw_internal

  openclaw-gateway:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: openclaw-gateway
    user: "1000:1000"
    restart: unless-stopped
    depends_on:
      - dockerproxy
    ports:
      - "18789:18789"
    environment:
      DOCKER_HOST: tcp://dockerproxy:2375
      OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN}
    command:
      - node
      - /app/openclaw.mjs
      - gateway
      - --allow-unconfigured
      - --bind
      - lan
      - --port
      - "18789"
      - --auth
      - token
      - --token
      - ${OPENCLAW_GATEWAY_TOKEN}
      - --verbose
    volumes:
      - /volume2/docker/openclaw-data:/home/node/.openclaw
    networks:
      - openclaw_internal

  openclaw-cli:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: openclaw-cli
    user: "1000:1000"
    depends_on:
      - openclaw-gateway
      - dockerproxy
    environment:
      DOCKER_HOST: tcp://dockerproxy:2375
      OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN}
    command:
      - sleep
      - infinity
    volumes:
      - /volume2/docker/openclaw-data:/home/node/.openclaw
    network_mode: "service:openclaw-gateway"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    healthcheck:
      disable: true

networks:
  openclaw_internal:
    driver: bridge