#
#  SPDX-License-Identifier: Apache-2.0
#
#  Copyright The original authors
#
#  Licensed under the Apache Software License version 2.0, available at http://www.apache.org/licenses/LICENSE-2.0
#

services:
  docker-proxy:
    image: tecnativa/docker-socket-proxy:0.3.0
    restart: unless-stopped
    privileged: true
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      # --- Allowed (Testcontainers needs these) ---
      CONTAINERS: 1
      IMAGES: 1
      NETWORKS: 1
      EXEC: 1
      POST: 1
      INFO: 1
      VERSION: 1
      PING: 1
      # --- Denied ---
      VOLUMES: 0     # block volume create/rm
      BUILD: 0       # no `docker build` from inside the claude container
      COMMIT: 0
      SYSTEM: 0      # blocks /system/prune
      SWARM: 0
      NODES: 0
      TASKS: 0
      SERVICES: 0
      PLUGINS: 0
      CONFIGS: 0
      SECRETS: 0
      SESSION: 0
      DISTRIBUTION: 0
    networks:
      - claude-net

  claude:
    build: .
    entrypoint: claude
    stdin_open: true  # -i
    tty: true         # -t
    depends_on:
      - docker-proxy
    volumes:
      - .:/workspace
      - claude-config:/claude-config
      - maven-repo:/root/.m2
    environment:
      - GH_TOKEN
      - COLORTERM=truecolor
      - CLAUDE_CONFIG_DIR=/claude-config
      # Testcontainers: talk to the proxy instead of the host socket
      - DOCKER_HOST=tcp://docker-proxy:2375
      - TESTCONTAINERS_RYUK_DISABLED=true
      - TESTCONTAINERS_HOST_OVERRIDE=host.docker.internal
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      - claude-net

volumes:
  claude-config:
  maven-repo:

networks:
  claude-net:
    driver: bridge