brainflex-node/docker-compose.yml at main · neurodatascience/brainflex-node · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
#
# Fed-BioMed node connected to the researcher through a WireGuard VPN
#
# Adapted from Fed-BioMed (Apache-2.0):
# https://github.com/fedbiomed/fedbiomed/blob/v6.4.1/envs/vpn/docker/docker-compose_run_node.yml
#

services:
  #
  # VPN client
  vpn:
    container_name: brainflex-vpn-${FBM_CONTAINER_INSTANCE_ID:-default}
    hostname: brainflex-node-${FBM_CONTAINER_INSTANCE_ID:-default}
    image: ghcr.io/neurodatascience/brainflex-vpn-client:0.1.0@sha256:1c353258abde508771422e71384301aea88915b2f34bd2e236f3c8a9ab250de4
    cap_add:
      - net_admin # needed to handle wireguard interface
    devices:
      - /dev/net/tun # needed to handle wireguard interface
    volumes:
      - ./vpn_config:/config # contains VPN configurations
    healthcheck:
      test: ["CMD", "ip", "link", "show", "wg0", "up"]
      interval: 10s
      start_period: 10s
    restart: unless-stopped
  #
  # Fed-BioMed node
  node:
    container_name: brainflex-node-${FBM_CONTAINER_INSTANCE_ID:-default}
    image: fedbiomed/node:${FBM_CONTAINER_VERSION_TAG:-unknown}
    network_mode: service:vpn
    depends_on:
      vpn:
        condition: service_healthy
        restart: true
    # start as root so that the entrypoint can remap the `fedbiomed` user to
    # CONTAINER_UID/CONTAINER_GID, it then drops privileges to `fedbiomed`
    user: root
    environment:
      - CONTAINER_UID
      - CONTAINER_GID
      - FBM_NODE_NAME
      - FBM_RESEARCHER_IP=${FBM_RESEARCHER_IP:-10.222.0.2}
      - FBM_RESEARCHER_PORT=${FBM_RESEARCHER_PORT:-50051}
      - MNIST_OFF=True
      - FBM_NODE_START_OPTIONS
      - FBM_SECURITY_FORCE_SECURE_AGGREGATION
      - FBM_SECURITY_TRAINING_PLAN_APPROVAL
      - FBM_SECURITY_ALLOW_DEFAULT_TRAINING_PLANS
      - FBM_SECURITY_ALLOW_PREPROC
      - FBM_SECURITY_ALLOW_FEDERATED_ANALYTICS
      - NIPOPPY_ROOT=/nipoppy_study
    volumes:
      - ./fbm-node:/fbm-node # hardcoded because it is hardcoded in the node image as well
      - ./scripts/set_node_name.sh:/entrypoint-root.sh:ro # sets the node name from FBM_NODE_NAME
      # Nipoppy study files
      - type: bind
        source: ${NIPOPPY_ROOT:-./nipoppy_study}
        target: /nipoppy_study
        read_only: true
        bind:
          create_host_path: false
    restart: unless-stopped