services:
  pipeline:
    build: .
    image: static-sft-pipeline:latest
    depends_on:
      docker-dind:
        condition: service_healthy
    working_dir: /workspace
    environment:
      DOCKER_HOST: tcp://docker-dind:2375
      DOCKER_API_VERSION: "1.43"
      NO_PROXY: localhost,127.0.0.1,docker-dind,github.com,.github.com,githubusercontent.com,.githubusercontent.com
      no_proxy: localhost,127.0.0.1,docker-dind,github.com,.github.com,githubusercontent.com,.githubusercontent.com
      ANTHROPIC_BASE_URL: ${ANTHROPIC_BASE_URL:-}
      MODEL_API_KEY: ${MODEL_API_KEY:-}
      ANTHROPIC_MODEL: ${MODEL_NAME:-GLM-5.3-Flash}
      ANTHROPIC_DEFAULT_OPUS_MODEL: ${MODEL_NAME:-GLM-5.3-Flash}
      ANTHROPIC_DEFAULT_SONNET_MODEL: ${MODEL_NAME:-GLM-5.3-Flash}
      ANTHROPIC_DEFAULT_HAIKU_MODEL: ${MODEL_NAME:-GLM-5.3-Flash}
      CLAUDE_CODE_SUBAGENT_MODEL: ${MODEL_NAME:-GLM-5.3-Flash}
      CLAUDE_CODE_EFFORT_LEVEL: ${CLAUDE_CODE_EFFORT_LEVEL:-max}
      CLAUDE_CODE_AUTO_COMPACT_WINDOW: ${CLAUDE_CODE_AUTO_COMPACT_WINDOW:-786432}
    volumes:
      - ./:/workspace
      - ../CVE-Factory-full/cve_tasks:/tasks:ro
    networks: [control]

  docker-dind:
    image: docker:24-dind
    privileged: true
    command: ["dockerd", "--host=tcp://0.0.0.0:2375", "--tls=false", "--config-file=/etc/docker/daemon.json"]
    environment:
      DOCKER_TLS_CERTDIR: ""
      HTTP_PROXY: ${DIND_HTTP_PROXY:-http://172.29.254.1:10081}
      HTTPS_PROXY: ${DIND_HTTPS_PROXY:-http://172.29.254.1:10081}
      NO_PROXY: localhost,127.0.0.1,docker-dind,github.com,.github.com,githubusercontent.com,.githubusercontent.com
      http_proxy: ${DIND_HTTP_PROXY:-http://172.29.254.1:10081}
      https_proxy: ${DIND_HTTPS_PROXY:-http://172.29.254.1:10081}
      no_proxy: localhost,127.0.0.1,docker-dind,github.com,.github.com,githubusercontent.com,.githubusercontent.com
    healthcheck:
      test: ["CMD-SHELL", "DOCKER_HOST=tcp://127.0.0.1:2375 docker info >/dev/null 2>&1"]
      interval: 5s
      timeout: 5s
      retries: 30
      start_period: 5s
    volumes:
      - ./:/workspace
      - ../CVE-Factory-full/cve_tasks:/tasks:ro
      - dind-data:/var/lib/docker
      - ./dind-daemon.json:/etc/docker/daemon.json:ro
    networks: [control]
    depends_on:
      proxy-bridge:
        condition: service_healthy

  proxy-bridge:
    image: cve-factory-dev:latest
    network_mode: host
    command: ["python3", "/proxy_bridge.py", "172.29.254.1", "10081", "127.0.0.1", "10080"]
    restart: unless-stopped
    volumes:
      - ./proxy_bridge.py:/proxy_bridge.py:ro
    healthcheck:
      test: ["CMD", "python3", "-c", "import socket; socket.create_connection(('172.29.254.1', 10081), 2).close()"]
      interval: 3s
      timeout: 3s
      retries: 10

networks:
  control:
    ipam:
      config:
        - subnet: 172.29.254.0/24

volumes:
  dind-data: