docker-compose.yml

# Cortex research network stack (Compose project name stays base)
#
# Default: postgres + validator + socket-proxy + the two live
# challenges (bounty, proof). relearn*, design, and prism are gone — they
# have no trust-root row and no remaining compose services.
# Master/owner host only:
#   docker compose --profile master up -d
# brings gateway as an additional service (D3). Use role-master.yml on
# operator hosts to disable the co-located validator. Updater is opt-in
# under the auto-update profile.
#
# External images are digest-pinned (no floating tags).
# docker.sock is mounted ONLY on socket-proxy (read-only).
# Secrets: age-decrypted env files mode 0600 under deploy/env/ (never baked into images).

name: base

services:
  postgres:
    image: postgres@sha256:33f923b05f64ca54ac4401c01126a6b92afe839a0aa0a52bc5aeb5cc958e5f20
    restart: unless-stopped
    env_file:
      - path: ./deploy/env/postgres.env
        required: true
    volumes:
      - base-pgdata:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U \"$$POSTGRES_USER\" -d \"$$POSTGRES_DB\""]
      interval: 5s
      timeout: 5s
      retries: 10
      start_period: 10s
    networks:
      - base
    # No host ports by default — apps reach postgres on the compose network.

  validator:
    image: validator:0.1.0
    build:
      context: .
      dockerfile: deploy/Dockerfile
      target: validator
      args:
        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    env_file:
      - path: ./deploy/env/validator.env
        required: true
    environment:
      BASE_ROLE: validator
      BASE_LISTEN: 0.0.0.0:8080
      # Optional co-located gateway (only present under profile master)
      BASE_GATEWAY_ENDPOINT: ${BASE_GATEWAY_ENDPOINT:-http://gateway:8080}
      # Owner-signed measurements for attest (image bakes /etc/base/config; host mount wins)
      BASE_TRUST_ROOT_DIR: ${BASE_TRUST_ROOT_DIR:-/etc/base/config}
    volumes:
      - ./config:/etc/base/config:ro
      - base-validator-lkg:/var/lib/base
    expose:
      - "8080"
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -fsS -m 5 http://127.0.0.1:8080/healthz || exit 1",
        ]
      interval: 10s
      timeout: 3s
      retries: 6
      start_period: 15s
    networks:
      - base
    # No docker.sock — updater talks via socket-proxy only.

  gateway:
    profiles: ["master"]
    image: gateway:0.1.0
    build:
      context: .
      dockerfile: deploy/Dockerfile
      target: gateway
      args:
        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    env_file:
      - path: ./deploy/env/gateway.env
        required: true
    environment:
      BASE_ROLE: gateway
      BASE_GATEWAY_LISTEN: 0.0.0.0:8080
      BASE_TRUST_ROOT_DIR: ${BASE_TRUST_ROOT_DIR:-/etc/base/config}
      # Bundle seal mini-secret (host file, never baked into image)
      BASE_GATEWAY_SK_FILE: ${BASE_GATEWAY_SK_FILE:-/run/secrets/gateway_sk}
    volumes:
      - ./config:/etc/base/config:ro
      - ./deploy/secrets/gateway_sk:/run/secrets/gateway_sk:ro
    expose:
      - "8080"
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS -m 5 http://127.0.0.1:8080/healthz || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 6
      # The gateway resolves the subnet owner from chain before it listens.
      start_period: 30s
    networks:
      - base

  # ---------------------------------------------------------------------------
  # TEST-ONLY adversarial gateway (task 48). NEVER on default or master path.
  # Enable explicitly:
  #   docker compose --profile evil-gateway up -d evil-gateway
  # Do NOT use in production. Staging offline proofs live in
  # crates/validator/src/adversarial_tests.rs (FakeChain / wiremock).
  # ---------------------------------------------------------------------------
  evil-gateway:
    profiles: ["evil-gateway"]
    image: gateway:0.1.0
    build:
      context: .
      dockerfile: deploy/Dockerfile
      target: gateway
      args:
        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
    # Test harness — no auto-restart loop that could look like prod.
    restart: "no"
    depends_on:
      postgres:
        condition: service_healthy
    env_file:
      - path: ./deploy/env/gateway.env
        required: false
    environment:
      BASE_ROLE: gateway
      BASE_GATEWAY_LISTEN: 0.0.0.0:8080
      # Marker so operators never confuse with prod gateway (master profile).
      BASE_EVIL_GATEWAY: "1"
      BASE_EVIL_SCENARIO: ${BASE_EVIL_SCENARIO:-inconsistent-vector}
    expose:
      - "8080"
    networks:
      - base

  updater:
    image: updater:0.1.0
    build:
      context: .
      dockerfile: deploy/Dockerfile
      target: updater
      args:
        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
    # The updater pulls its desired image from a registry, so it is only useful
    # when BASE_UPDATER_DESIRED_IMAGE is a registry reference. remote-deploy.sh
    # enables this profile automatically in that case.
    profiles: ["auto-update"]
    restart: unless-stopped
    depends_on:
      socket-proxy:
        condition: service_started
      validator:
        condition: service_started
    env_file:
      - path: ./deploy/env/updater.env
        required: true
    environment:
      BASE_UPDATER_PROXY_URL: http://socket-proxy:2375
      BASE_UPDATER_COMPOSE_PROJECT: base
      BASE_UPDATER_SERVICE_NAME: validator
      BASE_UPDATER_HEALTH_URL: http://validator:8080/readyz
      BASE_UPDATER_STATE_DIR: /var/lib/base-updater
      BASE_UPDATER_SELF_NAME: base-updater-1
    volumes:
      - base-updater-state:/var/lib/base-updater
    networks:
      - base
    # Talks to Docker Engine only through socket-proxy (allowlisted).

  # bounty-challenge — bug-report challenge (:8096). Pair + reports; Chat inject env-only.
  bounty-challenge:
    image: bounty-challenge:0.1.0
    build:
      context: .
      dockerfile: deploy/Dockerfile
      target: bounty-challenge
      args:
        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      BASE_CHALLENGE_BIND: 0.0.0.0:8096
      BASE_CHALLENGE_SK_FILE: /run/base/challenge_sk
      BOUNTY_CHAT_COMMAND: "${BOUNTY_CHAT_COMMAND:-}"
      # The only scorer. Empty → ingest 503s and every leaf is a burn.
      BOUNTY_BACKEND_PUBLIC_URL: "${BOUNTY_BACKEND_PUBLIC_URL:-}"
      BOUNTY_EMIT_POLL_SECS: "${BOUNTY_EMIT_POLL_SECS:-120}"
      BOUNTY_ADMIN_TOKENS_FILE: /run/base/bounty/admin_tokens
      BOUNTY_SESSION_SECRET_FILE: /run/base/bounty/session_secret
      # Emission posts signed leaves to the gateway that seals what validators
      # fetch. `BASE_NETUID` (expected set `E`) comes from the env file and the
      # chain endpoints from the env overlay.
      BASE_CHALLENGE_GATEWAY_ENDPOINT: ${BASE_CHALLENGE_GATEWAY_ENDPOINT:-http://gateway:8080}
    env_file:
      - path: ./deploy/env/bounty-challenge.env
        required: true
    volumes:
      - ./config:/etc/base/config:ro
      - ./deploy/secrets/bounty_sk:/run/base/challenge_sk:ro
      - ./deploy/secrets/lium:/run/base/lium:ro
      - ./deploy/secrets/bounty:/run/base/bounty:ro
    expose:
      - "8096"
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -fsS -m 5 http://127.0.0.1:8096/health || exit 1",
        ]
      interval: 10s
      timeout: 3s
      retries: 6
      start_period: 10s
    networks:
      - base

  # ---------------------------------------------------------------------------
  # proof-challenge — Proof (:8100). Miners submit a reproducible experiment
  # against an operator-published topic_id. The RLM judge lives in a
  # digest-pinned eval image; empty digest → every submit 503. Topics are
  # signed documents, not a catalog in git.
  # ---------------------------------------------------------------------------
  proof-challenge:
    image: proof-challenge:0.1.0
    build:
      context: .
      dockerfile: deploy/Dockerfile
      target: proof-challenge
      args:
        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      BASE_CHALLENGE_BIND: 0.0.0.0:8100
      BASE_CHALLENGE_SK_FILE: /run/base/challenge_sk
      # Sim eval unless the operator opts in. Never log LIUM_API_KEY.
      PROOF_FORCE_SIM: "${PROOF_FORCE_SIM:-false}"
      # Staging/dev only. Ignored unless PROOF_FORCE_SIM is on. Never a Lium path.
      PROOF_SIM_STUB_WIN: "${PROOF_SIM_STUB_WIN:-false}"
      PROOF_PIN_FILE: /etc/base/config/proof-pin.toml
      PROOF_TOPICS_FILE: /run/base/proof/topics.json
      PROOF_HOLDOUT_FILE: /run/base/proof/holdouts.json
      PROOF_BASELINE_FILE: /run/base/proof/baselines.json
      PROOF_ADMIN_TOKENS_FILE: /run/base/proof/admin_tokens
      PROOF_INFERENCE_OFFER_FILE: /run/base/proof/inference_offer.json
      PROOF_INFERENCE_API_KEY_FILE: /run/base/proof/inference_api_key
      # Live 1x EvalExecutorOffer (Lium template + proof deadline). Operator
      # state, no secret; missing/closed → can_score=false / submit 503.
      PROOF_EVAL_EXECUTOR_OFFER_FILE: /run/base/proof/eval_executor_offer.json
      # RLM artefact zips ({topic_id}/{submission_id}.zip, best.json,
      # events.jsonl) on the persistent proof-artifacts volume.
      PROOF_ARTEFACT_ROOT: /var/lib/proof/artefacts
      BASE_CHALLENGE_GATEWAY_ENDPOINT: ${BASE_CHALLENGE_GATEWAY_ENDPOINT:-http://gateway:8080}
    env_file:
      - path: ./deploy/env/proof-challenge.env
        required: true
    volumes:
      - ./config:/etc/base/config:ro
      - ./deploy/secrets/proof_sk:/run/base/challenge_sk:ro
      - ./deploy/secrets/lium:/run/base/lium:ro
      - ./deploy/secrets/proof:/run/base/proof:ro
      - proof-artifacts:/var/lib/proof
    expose:
      - "8100"
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -fsS -m 5 http://127.0.0.1:8100/health || exit 1",
        ]
      interval: 10s
      timeout: 3s
      retries: 6
      start_period: 10s
    networks:
      - base

  socket-proxy:
    image: tecnativa/docker-socket-proxy@sha256:9e4b9e7517a6b660f2cc903a19b257b1852d5b3344794e3ea334ff00ae677ac2
    restart: unless-stopped
    environment:
      # Shared proxy: updater rolls. App-level
      # Allowlist::updater / Allowlist::verifier enforce method/path; tecnativa
      # CONTAINERS includes DELETE for sandbox cleanup. NETWORKS stays off.
      CONTAINERS: "1"
      IMAGES: "1"
      POST: "1"
      # Everything else denied (explicit zeros for clarity)
      ALLOW_START: "1"
      ALLOW_STOP: "1"
      ALLOW_RESTARTS: "0"
      AUTH: "0"
      BUILD: "0"
      COMMIT: "0"
      CONFIGS: "0"
      DISTRIBUTION: "0"
      EVENTS: "1"
      EXEC: "0"
      INFO: "0"
      NETWORKS: "0"
      NODES: "0"
      PLUGINS: "0"
      SERVICES: "0"
      SESSION: "0"
      SWARM: "0"
      SYSTEM: "0"
      TASKS: "0"
      SECRETS: "0"
      VOLUMES: "0"
    volumes:
      # Sole host docker.sock mount on this stack (read-only).
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - base
    # Bound only on the internal network — never publish 2375 to the host.

volumes:
  base-pgdata:
  base-updater-state:
  base-validator-lkg:
  proof-artifacts:

networks:
  base:
    driver: bridge