docker-compose.yml

# Docker Compose for OpenUTM Verification (single-image GUI mode)
#
# Usage:
#   docker compose up --build
#
# Access the GUI at http://localhost:8989.
#
# For local development, run two processes directly on the host instead:
#   uv run uvicorn openutm_verification.server.main:app --reload --port 8989
#   cd web-editor && npm run dev   # Vite on :5173, proxies API to :8989

services:
  verification:
    image: openutm/verification:latest
    container_name: openutm-verification
    build:
      context: .
      dockerfile: Dockerfile
      args:
        UV_COMPILE_BYTECODE: 1
        UV_LINK_MODE: copy
        APP_USER: appuser
        APP_GROUP: appgrp
        UID: ${HOST_UID:-1000}
        GID: ${HOST_GID:-1000}
    environment:
      - OPENUTM_CONFIG_PATH=${OPENUTM_CONFIG_PATH:-/app/config/default.yaml}
      - PYTHONUNBUFFERED=1
      - TZ=UTC
      - LOG_LEVEL=${LOG_LEVEL:-INFO}
      - FLIGHT_BLENDER_URL=${FLIGHT_BLENDER_URL:-http://host.docker.internal:8000}
    # Bind to localhost by default. The GUI/API are unauthenticated and
    # /api/config supports live edits, so exposing on all interfaces is unsafe.
    # To expose intentionally, set HOST_BIND=0.0.0.0 (or a specific interface).
    ports:
      - "${HOST_BIND:-127.0.0.1}:8989:8989"
    # Volume mounts:
    #   - config: YAML config (read-write so the in-app Settings screen can
    #     persist edits via PUT /api/config back to default.yaml)
    #   - reports: Generated reports, persisted across restarts
    #   - scenarios: YAML scenario definitions (read-write so users can edit
    #     them without rebuilding the image)
    #
    # For Kubernetes: use ConfigMap for config, PersistentVolumeClaim for reports.
    # The `:Z` flag relabels mounts for SELinux hosts (Fedora/RHEL); it's
    # a no-op on macOS/Linux distros without SELinux.
    volumes:
      - ./config:/app/config:rw,Z
      - ./reports:/app/reports:rw,Z
      - ./scenarios:/app/scenarios:rw,Z
    extra_hosts:
      - "host.docker.internal:host-gateway"
    deploy:
      resources:
        limits:
          memory: 1G
          cpus: '1.0'
        reservations:
          memory: 256M
          cpus: '0.5'
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8989/health',timeout=5).status==200 else 1)"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s
    restart: unless-stopped
    labels:
      - "project=openutm-verification"
      - "component=verification"