name: ${SHIMPZ_PROJECT_NAME:?CLI must pin SHIMPZ_PROJECT_NAME}
services:
shimpz-account-egress-init:
container_name: shimpz-account-egress-init
image: ${SHIMPZ_EGRESS_IMAGE:?CLI must pin SHIMPZ_EGRESS_IMAGE}
platform: ${SHIMPZ_SPACE_PLATFORM:?CLI must pin SHIMPZ_SPACE_PLATFORM}
pull_policy: never
restart: "no"
user: "0:0"
network_mode: none
read_only: true
cap_drop:
- ALL
cap_add:
- CHOWN
security_opt:
- no-new-privileges:true
command: ["account-init"]
volumes:
- type: volume
source: account_egress_capability
target: /run/shimpz-account-egress
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
tmpfs:
- /tmp:rw,noexec,nosuid,nodev,size=8m
cpuset: "${SHIMPZ_CPUSET:?CLI must limit local CPUs}"
cpus: "0.25"
mem_limit: 64m
memswap_limit: 64m
pids_limit: 32
logging:
driver: none
team:
container_name: shimpz-team
image: ${SHIMPZ_TEAM_IMAGE:?CLI must pin SHIMPZ_TEAM_IMAGE}
platform: ${SHIMPZ_SPACE_PLATFORM:?CLI must pin SHIMPZ_SPACE_PLATFORM}
pull_policy: never
restart: on-failure
user: "10001:10001"
read_only: true
cap_drop:
- ALL
security_opt:
- no-new-privileges:true
group_add:
- "${SHIMPZ_DOCKER_GID:?CLI must bind the Docker socket group}"
- "10016"
- "10017"
- "10021"
- "10022"
environment:
SHIMPZ_SPACE_ID: ${SHIMPZ_SPACE_ID:?CLI must preserve SHIMPZ_SPACE_ID}
SHIMPZ_BRAIN_RUNTIME_URL: http://brain:8080
SHIMPZ_BRAIN_RUNTIME_TOKEN_FILE: /run/shimpz-brain-runtime/token
SHIMPZ_LOCAL_ACTION_JOURNAL_PATH: /var/lib/shimpz-local/action-journal/journal.sqlite3
SHIMPZ_LOCAL_CHAT_CONTINUATIONS_STATE_PATH: /var/lib/shimpz-local/chat-continuations/state/continuations.json
SHIMPZ_LOCAL_CHAT_CONTINUATIONS_KEY_PATH: /var/lib/shimpz-local/chat-continuations/key/aes256.key
SHIMPZ_OAUTH_BROKER_PROXY_HOST: shimpz-account-egress
SHIMPZ_OAUTH_BROKER_PROXY_CAPABILITY_FILE: /run/shimpz-account-egress/token
SHIMPZ_ASSISTANT_EGRESS_CONTAINER: shimpz-assistant-egress
SHIMPZ_ASSISTANT_EGRESS_POLICY_DIR: /var/lib/shimpz-local/assistant-egress
volumes:
- type: bind
source: ${SHIMPZ_DOCKER_SOCKET:?CLI must bind the platform Docker socket}
target: /var/run/docker.sock
bind:
create_host_path: false
- type: volume
source: controller_token
target: /run/shimpz-local
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: controller_audit
target: /var/log/shimpz-local
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: controller_storage
target: /var/lib/shimpz-local/storage
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: controller_inference
target: /var/lib/shimpz-local/inference
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: controller_action_journal
target: /var/lib/shimpz-local/action-journal
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: controller_publications
target: /var/lib/shimpz-local/publications
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: controller_cosign_trust
target: /var/lib/shimpz-local/cosign
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: controller_assistant_integration_state
target: /var/lib/shimpz-local/assistant-integrations/state
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: controller_assistant_integration_key
target: /var/lib/shimpz-local/assistant-integrations/key
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: controller_chat_continuation_state
target: /var/lib/shimpz-local/chat-continuations/state
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: controller_chat_continuation_key
target: /var/lib/shimpz-local/chat-continuations/key
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: assistant_egress_policy
target: /var/lib/shimpz-local/assistant-egress
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: brain_runtime_token
target: /run/shimpz-brain-runtime
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: supervisor_key
target: /run/shimpz-local-supervisor
read_only: true
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: account_egress_capability
target: /run/shimpz-account-egress
read_only: true
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
tmpfs:
- /tmp:rw,noexec,nosuid,nodev,size=32m
cpuset: "${SHIMPZ_CPUSET:?CLI must limit local CPUs}"
cpus: "1.0"
mem_limit: 256m
memswap_limit: 256m
pids_limit: 128
stop_grace_period: 15s
logging:
driver: none
depends_on:
shimpz-account-egress-init:
condition: service_completed_successfully
shimpz-assistant-egress:
condition: service_started
shimpz-assistant-release:
condition: service_healthy
shimpz-account-egress:
condition: service_healthy
networks:
- control
- brain_runtime
- account_egress
- assistant_release
shimpz-assistant-egress:
container_name: shimpz-assistant-egress
image: ${SHIMPZ_EGRESS_IMAGE:?CLI must pin SHIMPZ_EGRESS_IMAGE}
platform: ${SHIMPZ_SPACE_PLATFORM:?CLI must pin SHIMPZ_SPACE_PLATFORM}
pull_policy: never
restart: on-failure
user: "10005:10005"
command: ["assistant"]
group_add:
- "10017"
read_only: true
cap_drop:
- ALL
security_opt:
- no-new-privileges:true
labels:
com.shimpz.local.managed: "1"
com.shimpz.local.profile: local-v1
com.shimpz.local.space-id: ${SHIMPZ_SPACE_ID:?CLI must preserve SHIMPZ_SPACE_ID}
com.shimpz.local.kind: assistant-egress
environment:
SHIMPZ_ASSISTANT_EGRESS_PORT: "8889"
SHIMPZ_ASSISTANT_EGRESS_POLICY_DIR: /policy
SHIMPZ_ASSISTANT_EGRESS_AUDIT_LOG: /var/log/assistant-egress/audit.jsonl
SHIMPZ_ASSISTANT_EGRESS_MAX_CONCURRENCY: "64"
SHIMPZ_ASSISTANT_EGRESS_MAX_SOURCE_CONCURRENCY: "8"
SHIMPZ_ASSISTANT_EGRESS_LISTEN_BACKLOG: "16"
volumes:
- type: volume
source: assistant_egress_policy
target: /policy
read_only: true
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: assistant_egress_audit
target: /var/log/assistant-egress
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
tmpfs:
- /tmp:rw,noexec,nosuid,nodev,size=16m
healthcheck:
test: ["CMD", "python3", "/app/entrypoint.py", "healthcheck", "assistant"]
interval: 30s
timeout: 3s
retries: 3
start_period: 30s
start_interval: 1s
cpuset: "${SHIMPZ_CPUSET:?CLI must limit local CPUs}"
cpus: "1.0"
mem_limit: 256m
memswap_limit: 256m
pids_limit: 128
ulimits:
nofile:
soft: 512
hard: 512
stop_grace_period: 15s
logging:
driver: none
networks:
- assistant_egress_out
shimpz-assistant-release:
container_name: shimpz-assistant-release
image: ${SHIMPZ_EGRESS_IMAGE:?CLI must pin SHIMPZ_EGRESS_IMAGE}
platform: ${SHIMPZ_SPACE_PLATFORM:?CLI must pin SHIMPZ_SPACE_PLATFORM}
pull_policy: never
restart: on-failure
user: "10004:10004"
command: ["release"]
read_only: true
cap_drop:
- ALL
security_opt:
- no-new-privileges:true
labels:
com.shimpz.local.managed: "1"
com.shimpz.local.profile: local-v1
com.shimpz.local.space-id: ${SHIMPZ_SPACE_ID:?CLI must preserve SHIMPZ_SPACE_ID}
com.shimpz.local.kind: assistant-release
environment:
SHIMPZ_EGRESS_ALLOW: developers.shimpz.com,ghcr.io,tuf-repo-cdn.sigstore.dev,rekor.sigstore.dev,pkg-containers.githubusercontent.com
SHIMPZ_EGRESS_AUDIT_LOG: /var/log/assistant-release/audit.jsonl
SHIMPZ_EGRESS_MAX_CONCURRENCY: "16"
SHIMPZ_EGRESS_MAX_SOURCE_CONCURRENCY: "4"
SHIMPZ_EGRESS_LISTEN_BACKLOG: "8"
volumes:
- type: volume
source: assistant_release_audit
target: /var/log/assistant-release
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
tmpfs:
- /tmp:rw,noexec,nosuid,nodev,size=8m
healthcheck:
test: ["CMD", "python3", "/app/entrypoint.py", "healthcheck", "release"]
interval: 30s
timeout: 3s
retries: 3
start_period: 30s
start_interval: 1s
cpuset: "${SHIMPZ_CPUSET:?CLI must limit local CPUs}"
cpus: "0.5"
mem_limit: 128m
memswap_limit: 128m
pids_limit: 64
ulimits:
nofile:
soft: 256
hard: 256
stop_grace_period: 15s
logging:
driver: none
networks:
- assistant_release
- assistant_release_out
shimpz-account-egress:
container_name: shimpz-account-egress
image: ${SHIMPZ_EGRESS_IMAGE:?CLI must pin SHIMPZ_EGRESS_IMAGE}
platform: ${SHIMPZ_SPACE_PLATFORM:?CLI must pin SHIMPZ_SPACE_PLATFORM}
pull_policy: never
restart: on-failure
user: "10006:10006"
command: ["account"]
group_add:
- "10022"
read_only: true
cap_drop:
- ALL
security_opt:
- no-new-privileges:true
labels:
com.shimpz.local.managed: "1"
com.shimpz.local.profile: local-v1
com.shimpz.local.space-id: ${SHIMPZ_SPACE_ID:?CLI must preserve SHIMPZ_SPACE_ID}
com.shimpz.local.kind: account-egress
volumes:
- type: volume
source: account_egress_capability
target: /run/shimpz-account-egress
read_only: true
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: account_egress_audit
target: /var/log/account-egress
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
tmpfs:
- /tmp:rw,noexec,nosuid,nodev,size=8m
cpuset: "${SHIMPZ_CPUSET:?CLI must limit local CPUs}"
cpus: "0.5"
mem_limit: 128m
memswap_limit: 128m
pids_limit: 64
ulimits:
nofile:
soft: 256
hard: 256
stop_grace_period: 15s
depends_on:
shimpz-account-egress-init:
condition: service_completed_successfully
logging:
driver: none
networks:
- account_egress
- account_egress_out
healthcheck:
test: ["CMD", "python3", "/app/entrypoint.py", "healthcheck", "account"]
interval: 30s
timeout: 3s
retries: 3
start_period: 30s
start_interval: 1s
shimpz-brain-egress:
container_name: shimpz-brain-egress
image: ${SHIMPZ_EGRESS_IMAGE:?CLI must pin SHIMPZ_EGRESS_IMAGE}
platform: ${SHIMPZ_SPACE_PLATFORM:?CLI must pin SHIMPZ_SPACE_PLATFORM}
pull_policy: never
restart: on-failure
user: "10001:10001"
command: ["brain"]
read_only: true
cap_drop:
- ALL
security_opt:
- no-new-privileges:true
environment:
SHIMPZ_EGRESS_AUDIT_LOG: /var/log/brain-egress/audit.jsonl
SHIMPZ_EGRESS_MAX_CONCURRENCY: "64"
SHIMPZ_EGRESS_MAX_SOURCE_CONCURRENCY: "8"
SHIMPZ_EGRESS_LISTEN_BACKLOG: "16"
labels:
com.shimpz.local.managed: "1"
com.shimpz.local.profile: local-v1
com.shimpz.local.space-id: ${SHIMPZ_SPACE_ID:?CLI must preserve SHIMPZ_SPACE_ID}
com.shimpz.local.kind: brain-egress
volumes:
- type: volume
source: brain_egress_audit
target: /var/log/brain-egress
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
tmpfs:
- /tmp:rw,noexec,nosuid,nodev,size=16m
cpuset: "${SHIMPZ_CPUSET:?CLI must limit local CPUs}"
cpus: "1.0"
mem_limit: 256m
memswap_limit: 256m
pids_limit: 128
ulimits:
nofile:
soft: 512
hard: 512
stop_grace_period: 15s
logging:
driver: none
networks:
- brain_egress
- brain_egress_out
healthcheck:
test: ["CMD", "python3", "/app/entrypoint.py", "healthcheck", "brain"]
interval: 30s
timeout: 4s
retries: 3
start_period: 30s
start_interval: 1s
brain:
container_name: shimpz-brain
image: ${SHIMPZ_BRAIN_IMAGE:?CLI must pin SHIMPZ_BRAIN_IMAGE}
platform: ${SHIMPZ_SPACE_PLATFORM:?CLI must pin SHIMPZ_SPACE_PLATFORM}
pull_policy: never
restart: on-failure
user: "10001:10001"
group_add:
- "10016"
read_only: true
cap_drop:
- ALL
security_opt:
- no-new-privileges:true
environment:
LANGCHAIN_TRACING_V2: "false"
LANGSMITH_TRACING: "false"
HTTPS_PROXY: http://shimpz-brain-egress:8888
HTTP_PROXY: http://shimpz-brain-egress:8888
https_proxy: http://shimpz-brain-egress:8888
http_proxy: http://shimpz-brain-egress:8888
NO_PROXY: localhost,127.0.0.1,::1
no_proxy: localhost,127.0.0.1,::1
SHIMPZ_BRAIN_RUNTIME_TOKEN_FILE: /run/shimpz-brain-runtime/token
SHIMPZ_BRAIN_RUNTIME_STATE: /var/lib/shimpz-brain-runtime/checkpoints.sqlite3
volumes:
- type: volume
source: brain_runtime_token
target: /run/shimpz-brain-runtime
read_only: true
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: brain_runtime_state
target: /var/lib/shimpz-brain-runtime
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
tmpfs:
- /tmp:rw,noexec,nosuid,nodev,size=64m
cpuset: "${SHIMPZ_CPUSET:?CLI must limit local CPUs}"
cpus: "2.0"
mem_limit: 1g
memswap_limit: 1g
pids_limit: 128
stop_grace_period: 15s
depends_on:
team:
condition: service_healthy
shimpz-brain-egress:
condition: service_healthy
logging:
driver: none
networks:
- brain_runtime
- brain_egress
admin:
container_name: shimpz-admin
image: ${SHIMPZ_ADMIN_IMAGE:?CLI must pin SHIMPZ_ADMIN_IMAGE}
platform: ${SHIMPZ_SPACE_PLATFORM:?CLI must pin SHIMPZ_SPACE_PLATFORM}
pull_policy: never
restart: on-failure
user: "1000:1000"
group_add:
- "10010"
- "10021"
read_only: true
cap_drop:
- ALL
security_opt:
- no-new-privileges:true
ports:
- "127.0.0.1:${SHIMPZ_PORT:-7777}:4600"
environment:
SHIMPZ_ADMIN_PROFILE: local
SHIMPZ_TEAM_URL: http://team:7077
SHIMPZ_TEAM_TOKEN_FILE: /run/shimpz-local/token
SHIMPZ_TEAM_CREDENTIALS_ENABLED: "0"
SHIMPZ_ADMIN_ALLOWED_ORIGINS: ${SHIMPZ_ADMIN_ALLOWED_ORIGINS:?CLI must pin Admin origins}
SHIMPZ_SPACE_ID: ${SHIMPZ_SPACE_ID:?CLI must pin Space identity}
volumes:
- type: volume
source: config
target: /repo
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: data
target: /data
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: controller_token
target: /run/shimpz-local
read_only: true
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: supervisor_key
target: /run/shimpz-local-supervisor
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: release_status
target: /run/shimpz-local-release
read_only: true
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
- type: volume
source: reset_capability
target: /run/shimpz-local-reset
read_only: true
volume:
nocopy: {{SHIMPZ_VOLUME_NOCOPY}}
tmpfs:
- /tmp:rw,noexec,nosuid,nodev,size=32m
healthcheck:
test: ["CMD", "python", "-c", "import urllib.request; request=urllib.request.Request('http://127.0.0.1:4600/api/session', method='POST'); urllib.request.urlopen(request, timeout=2).read()"]
interval: 30s
timeout: 3s
retries: 3
start_period: 30s
start_interval: 1s
cpus: "2.0"
cpuset: "${SHIMPZ_CPUSET:?CLI must limit local CPUs}"
mem_limit: 512m
memswap_limit: 512m
pids_limit: 128
stop_grace_period: 15s
depends_on:
team:
condition: service_healthy
brain:
condition: service_healthy
logging:
driver: none
networks:
- control
- egress
volumes:
{{SHIMPZ_VOLUME_DEFINITIONS}}
networks:
control:
driver: bridge
internal: true
brain_runtime:
driver: bridge
internal: true
brain_egress:
driver: bridge
internal: true
brain_egress_out:
driver: bridge
assistant_egress_out:
driver: bridge
assistant_release:
driver: bridge
internal: true
assistant_release_out:
driver: bridge
account_egress:
driver: bridge
internal: true
account_egress_out:
driver: bridge
egress:
driver: bridge