agentmon/docker-compose.yml at main · diffsec/agentmon · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
# agentmon Docker Compose Configuration
#
# Usage:
#   docker-compose up -d          # Start agentmon
#   docker-compose logs -f        # View logs
#   docker-compose down           # Stop agentmon
#
# Access:
#   HTTP API: http://localhost:18080
#   gRPC API: localhost:9090

version: '3.8'

services:
  agentmon:
    image: ghcr.io/diffsec/agentmon:latest
    # Or build locally:
    # build:
    #   context: .
    #   dockerfile: Dockerfile.example

    container_name: agentmon
    hostname: agentmon

    # Required capabilities for full functionality
    cap_add:
      - SYS_ADMIN      # Required for FUSE, namespaces
      - NET_ADMIN      # Required for network namespace, iptables

    # Required devices
    devices:
      - /dev/fuse      # Required for FUSE filesystem

    # Security options
    security_opt:
      - apparmor=unconfined    # Required for namespace operations
      # For SELinux systems, also add:
      # - label=disable

    # Port mappings
    ports:
      - "18080:18080"    # HTTP API
      - "9090:9090"    # gRPC API

    # Volume mounts
    volumes:
      # Workspace directory - where agent code runs
      - ./workspaces:/workspaces

      # Custom configuration (optional)
      - ./config:/etc/agentmon:ro

      # Persistent data (session history, logs)
      - agentmon-data:/var/lib/agentmon

      # Logs
      - agentmon-logs:/var/log/agentmon

    # Environment variables
    environment:
      - AGENTMON_LOG_LEVEL=info
      # Policy selection (name without .yml suffix). Must be in policies.allowed or defaults to policies.default.
      # - AGENTMON_POLICY_NAME=default
      # Optional env iteration block via shim for commands with env_policy.block_iteration=true
      # - AGENTMON_ENV_BLOCK_ITERATION=0
      # - AGENTMON_HTTP_ADDR=0.0.0.0:18080
      # - AGENTMON_GRPC_ADDR=0.0.0.0:9090

    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '4'
          memory: 4G
        reservations:
          cpus: '1'
          memory: 512M

    # Health check
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:18080/health"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s

    # Restart policy
    restart: unless-stopped

    # Logging
    logging:
      driver: "json-file"
      options:
        max-size: "100m"
        max-file: "3"

# Named volumes for persistence
volumes:
  agentmon-data:
    driver: local
  agentmon-logs:
    driver: local

# Optional: custom network
networks:
  default:
    name: agentmon-network