services:
  ai-monitoring:
    build: .
    image: ai-monitoring:1.8.24
    container_name: ai-monitoring
    restart: unless-stopped
    # Secrets + endpoints come from .env (git-ignored). Never inline keys here.
    env_file: .env
    # See host processes (top apps by CPU/RAM) rather than only the container's
    # PID namespace. Comment out to restrict to in-container processes.
    pid: host
    ports:
      - "${MONITOR_PORT:-9925}:9925"
    # F1: the monitor reaches Docker ONLY through the read-only socket proxy below
    # (never the raw host-root socket). Container monitoring still needs
    # MONITOR_CONTAINERS in .env. Remove this line + the docker-socket-proxy
    # service to disable container monitoring entirely.
    environment:
      MONITOR_DOCKER_API_URL: "http://docker-socket-proxy:2375"
    depends_on:
      - docker-socket-proxy
    volumes:
      - ai-monitoring-data:/data
      # Remote-GPU SSH mode: mount your private key read-only and set
      # GPU_SSH_KEY=/keys/gpu_key in .env (uncomment to use).
      # - ./gpu_key:/keys/gpu_key:ro
    # host.docker.internal lets the container reach LLM backends on the host.
    extra_hosts:
      - "host.docker.internal:host-gateway"
    healthcheck:
      test: ["CMD", "python", "-c",
             "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:9925/healthz',timeout=4).status==200 else 1)"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s

  # F1: read-only Docker socket proxy. It holds the real socket and exposes ONLY
  # GET /containers (everything else — exec, create, images, networks — is denied),
  # so a compromise of the monitor cannot reach the host-root Docker API. The proxy
  # is not published on any host port; only ai-monitoring can reach it on the
  # internal network. See github.com/Tecnativa/docker-socket-proxy.
  docker-socket-proxy:
    image: ghcr.io/tecnativa/docker-socket-proxy:latest
    container_name: ai-monitoring-docker-proxy
    restart: unless-stopped
    environment:
      CONTAINERS: 1          # allow GET /containers (list + inspect) only
      POST: 0                # deny all writes (create/exec/start/stop/…)
      IMAGES: 0
      NETWORKS: 0
      VOLUMES: 0
      EXEC: 0
      INFO: 0
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    # no ports: — internal network only, never exposed to the host

volumes:
  ai-monitoring-data: