docker-compose.multi-user.yml

Rama main · réplica de lectura del repositorio original.

# Open ACE - Multi-User Workspace Docker Compose Configuration
# Extension of docker-compose.yml for multi-user workspace mode
#
# IMPORTANT: This configuration runs containers as root (user: "0")
# Multi-user workspace mode requires root to:
#   - Create system users (useradd)
#   - Change file ownership (chown)
#   - Run processes as different users (sudo -u)
#
# SECURITY REQUIREMENTS (Issue #1893):
#   1. Set WORKSPACE_ISOLATION_BACKEND=plain
#   2. Set OPENACE_ALLOW_ROOT_MULTI_USER=1 (explicit opt-in)
#   3. Set strong DB_PASSWORD (NOT ace-secret or other defaults)
#   4. Set SECRET_KEY, OPENACE_ENCRYPTION_KEY, UPLOAD_AUTH_KEY in production
#
# Usage:
#   ./scripts/bootstrap-compose-env.sh
#   docker compose -f docker-compose.yml -f docker-compose.multi-user.yml up -d
#
# Alternative using environment variables:
#   WORKSPACE_ISOLATION_BACKEND=plain \
#   OPENACE_ALLOW_ROOT_MULTI_USER=1 \
#   docker compose -f docker-compose.yml -f docker-compose.multi-user.yml up -d
#
# Config persistence for multi-user mode (Issue #2235):
#   OPENACE_CONFIG_DIR is set to /home/open-ace/.open-ace to ensure
#   configuration persists to the config-data volume mounted in docker-compose.yml.
#   This fixes the issue where root user's default config path (/root/.open-ace)
#   would not persist to the mounted volume.

services:
  open-ace:
    # Override user for multi-user workspace mode
    # Required for: useradd, chown, sudo -u operations
    user: "0"

    environment:
      # Multi-user workspace mode (required)
      - WORKSPACE_ISOLATION_BACKEND=plain
      # Explicit root opt-in (Issue #1893)
      - OPENACE_ALLOW_ROOT_MULTI_USER=1
      # IMPORTANT: OPENACE_CONFIG_DIR must match the volume mount path in
      # docker-compose.yml (config-data:/home/open-ace/.open-ace).
      # This ensures configuration persists correctly when running as root.
      - OPENACE_CONFIG_DIR=/home/open-ace/.open-ace
      # Security mode - recommend production for actual deployments
      - OPENACE_SECURITY_MODE=${OPENACE_SECURITY_MODE:-production}
      # Fail before container creation when production bootstrap was skipped.
      - DB_PASSWORD=${DB_PASSWORD:?Run ./scripts/bootstrap-compose-env.sh first}
      - SECRET_KEY=${SECRET_KEY:?Run ./scripts/bootstrap-compose-env.sh first}
      - OPENACE_ENCRYPTION_KEY=${OPENACE_ENCRYPTION_KEY:?Run ./scripts/bootstrap-compose-env.sh first}
      # Pass CI environment variable for entrypoint CI detection (Issue #3109)
      - CI=${CI:-}

    # Issue #2729: Share /home directory with scheduler for Qwen session collection
    # Users' .qwen/projects directories are stored under /home/<username>/
    volumes:
      - home-data:/home

  # Issue #2729: Scheduler service for multi-user mode
  # Needs access to /home to collect Qwen sessions from users' .qwen/projects
  # Issue #2742: Must run as root to sync system users
  scheduler:
    extends:
      file: docker-compose.yml
      service: scheduler
    # Issue #3128 / #3455: scheduler must start by default in multi-user mode.
    # Compose MERGES `profiles` across merged files, so a bare `profiles: []`
    # here cannot remove the `profiles: [scheduler]` inherited from
    # docker-compose.yml — the scheduler stayed opt-in (Issue #3455). The
    # `!override` tag switches to replacement semantics: the inherited list
    # is discarded and the empty list makes the service always start.
    # Requires Docker Compose >= v2.24 (2024-01); CI's ubuntu-24.04 runners
    # satisfy this.
    profiles: !override []
    user: "0"
    environment:
      # Multi-user workspace mode (required)
      - WORKSPACE_ISOLATION_BACKEND=plain
      # Workspace base directory - required for _is_docker_multi_user_mode() check (Issue #3134)
      - WORKSPACE_BASE_DIR=/workspace
      # Explicit root opt-in (Issue #1893)
      - OPENACE_ALLOW_ROOT_MULTI_USER=1
      # IMPORTANT: OPENACE_CONFIG_DIR must match the volume mount path in
      # docker-compose.yml (config-data:/home/open-ace/.open-ace).
      # This ensures configuration persists correctly when running as root.
      - OPENACE_CONFIG_DIR=/home/open-ace/.open-ace
      # Security mode - recommend production for actual deployments
      - OPENACE_SECURITY_MODE=${OPENACE_SECURITY_MODE:-production}
      - DB_PASSWORD=${DB_PASSWORD:?Run ./scripts/bootstrap-compose-env.sh first}
      - SECRET_KEY=${SECRET_KEY:?Run ./scripts/bootstrap-compose-env.sh first}
      - OPENACE_ENCRYPTION_KEY=${OPENACE_ENCRYPTION_KEY:?Run ./scripts/bootstrap-compose-env.sh first}
      - UPLOAD_AUTH_KEY=${UPLOAD_AUTH_KEY:?Run ./scripts/bootstrap-compose-env.sh first}
      # Pass CI environment variable for entrypoint CI detection (Issue #3109)
      - CI=${CI:-}
    volumes:
      - home-data:/home

  postgres:
    environment:
      - POSTGRES_PASSWORD=${DB_PASSWORD:?Run ./scripts/bootstrap-compose-env.sh first}

# Issue #2729: Named volume for multi-user home directories
# Shared between open-ace and scheduler containers for session collection
volumes:
  home-data:
    driver: local