docker-compose.secure.yml

version: '3.8'

# ============================================
# CLAWD SECURE - DOCKER COMPOSE
# Full stack with security hardening
# ============================================

services:
  # Docker Socket Proxy (Directive 2)
  # Provides controlled access to Docker API
  socket-proxy:
    image: tecnativa/docker-socket-proxy:latest
    container_name: clawd-socket-proxy
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - CONTAINERS=1
      - IMAGES=0
      - NETWORKS=0
      - VOLUMES=0
      - POST=0
      - DELETE=0
    networks:
      - clawd-internal
    security_opt:
      - no-new-privileges:true

  # Main Application (Moltbot + Clawd Secure)
  clawd-secure:
    build:
      context: .
      dockerfile: Dockerfile.secure
    container_name: clawd-secure-moltbot
    restart: unless-stopped
    user: "1001:1001" # clawduser
    ports:
      - "127.0.0.1:3000:3000" # Bind to localhost ONLY
    env_file:
      - .env
    environment:
      - NODE_ENV=production
      - DOCKER_HOST=tcp://socket-proxy:2375
    volumes:
      - ./data:/app/data
      - ./sessions:/app/sessions
    depends_on:
      - socket-proxy
    networks:
      - clawd-internal
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    security_opt:
      - no-new-privileges:true
    read_only: false # Set to true if you don't need write access
    tmpfs:
      - /tmp:noexec,nosuid,nodev,size=100m
    healthcheck:
      test: [ "CMD", "node", "-e", "require('http').get('http://localhost:3000/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1))" ]
      interval: 30s
      timeout: 10s
      start_period: 40s
      retries: 3

# Networks
networks:
  clawd-internal:
    driver: bridge
    internal: false # Set to true for complete isolation (no internet)
    ipam:
      config:
        - subnet: 172.20.0.0/16