67 lines
2.5 KiB
YAML
67 lines
2.5 KiB
YAML
services:
|
|
# ─── Proxy sidecar ─────────────────────────────────────────────────────────
|
|
# Bridges the isolated internal network to the internet.
|
|
# Enforces an egress allowlist — see proxy/squid.conf.
|
|
proxy:
|
|
image: registry.zeidler.dev/docker-public/playground/docker-claude-proxy:${IMAGE_TAG:-latest}
|
|
networks:
|
|
- claude-internal # reachable by claude container
|
|
- proxy-external # has outbound internet access
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp
|
|
- /var/cache/squid
|
|
- /var/log/squid
|
|
|
|
# ─── Claude Code CLI container ─────────────────────────────────────────────
|
|
# No direct internet access. All egress routes through the proxy sidecar.
|
|
# Run via "docker compose run --rm --service-ports claude" (managed by claude.sh).
|
|
claude:
|
|
image: registry.zeidler.dev/docker-public/playground/docker-claude-claude:${IMAGE_TAG:-latest}
|
|
depends_on:
|
|
proxy:
|
|
condition: service_healthy
|
|
networks:
|
|
- claude-internal # only — no route to the internet
|
|
environment:
|
|
- ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
|
|
- CLAUDE_CODE_OAUTH_TOKEN=${CLAUDE_CODE_OAUTH_TOKEN:-}
|
|
- HTTP_PROXY=http://proxy:3128
|
|
- HTTPS_PROXY=http://proxy:3128
|
|
- ALL_PROXY=http://proxy:3128
|
|
- NO_PROXY=localhost,127.0.0.1
|
|
# MCP server credentials — all optional; servers are skipped if unset
|
|
- GITHUB_TOKEN=${GITHUB_TOKEN:-}
|
|
- GITLAB_TOKEN=${GITLAB_TOKEN:-}
|
|
- GITLAB_URL=${GITLAB_URL:-https://gitlab.com}
|
|
- ATLASSIAN_SITE_NAME=${ATLASSIAN_SITE_NAME:-}
|
|
- ATLASSIAN_USER_EMAIL=${ATLASSIAN_USER_EMAIL:-}
|
|
- ATLASSIAN_API_TOKEN=${ATLASSIAN_API_TOKEN:-}
|
|
ports:
|
|
# OAuth callback — required for browser-based login (claude login)
|
|
- "0.0.0.0:54545:54545"
|
|
volumes:
|
|
- ${HOME}/.claude:/home/node/.claude
|
|
# Workspace is injected by claude.sh via --volume flag at run time (current directory).
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
stdin_open: true
|
|
tty: true
|
|
|
|
networks:
|
|
# Internal-only: Docker adds no default gateway → no direct internet route
|
|
claude-internal:
|
|
driver: bridge
|
|
internal: true
|
|
|
|
# External: standard bridge with internet access (proxy only)
|
|
proxy-external:
|
|
driver: bridge
|
|
|