incidentfox/docker-compose.yml at main · Dillettant/incidentfox · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
version: '3.8'

# Docker Compose setup for IncidentFox self-hosted installation
# Provides container isolation and resource limits

services:
  # Credential resolver - loads secrets from .env, injects into requests
  credential-resolver:
    build:
      context: ./sre-agent/credential-proxy
      dockerfile: Dockerfile
    container_name: incidentfox-credential-resolver
    restart: unless-stopped
    environment:
      - CREDENTIAL_SOURCE=environment
    env_file:
      - .env
    healthcheck:
      test: ["CMD", "python", "-c", "import httpx; httpx.get('http://localhost:8002/health').raise_for_status()"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 10s
    networks:
      - app_network

  # Envoy proxy - routes requests, calls credential-resolver for auth headers
  envoy:
    image: envoyproxy/envoy:v1.28-latest
    container_name: incidentfox-envoy
    restart: unless-stopped
    ports:
      - "9901:9901"  # Admin interface
    volumes:
      - ./sre-agent/credential-proxy/envoy/envoy-local.yaml:/etc/envoy/envoy.yaml:ro
    depends_on:
      credential-resolver:
        condition: service_healthy
    command: ["--config-path", "/etc/envoy/envoy.yaml", "--log-level", "debug"]
    dns:
      - 8.8.8.8
      - 8.8.4.4
    networks:
      - app_network
      - default  # Needs external access to reach upstream APIs

  # SRE Agent - runs investigations
  sre-agent:
    build:
      context: ./sre-agent
      dockerfile: Dockerfile.simple
    container_name: incidentfox-sre-agent
    restart: unless-stopped
    environment:
      # Proxy mode - no secrets in agent!
      - ANTHROPIC_BASE_URL=http://envoy:8001
      - ANTHROPIC_API_KEY=sk-ant-placeholder-proxy-will-inject-real-key
      # Coralogix routed through proxy (credentials injected)
      - CORALOGIX_BASE_URL=http://envoy:8001
      # Tenant context for credential lookup
      - INCIDENTFOX_TENANT_ID=local
      - INCIDENTFOX_TEAM_ID=local
      # Coralogix config (no API key - injected by proxy)
      - CORALOGIX_DOMAIN=${CORALOGIX_DOMAIN:-}
      # Other services
      - LMNR_PROJECT_API_KEY=${LMNR_PROJECT_API_KEY:-}
    depends_on:
      envoy:
        condition: service_started
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    # Note: Cannot use read_only:true because Claude Code CLI needs to write
    # But we limit writable locations with tmpfs
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=500m
      - /home/agent/.cache:rw,noexec,nosuid,size=200m
    mem_limit: 2g
    cpus: 2
    pids_limit: 100
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    ports:
      - "8000:8000"  # Expose for local testing
    networks:
      - app_network
      - default  # Needs external access for API calls
    healthcheck:
      test: ["CMD", "python", "-c", "import requests; requests.get('http://localhost:8000/health')"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

  # Slack Bot - connects Slack to SRE Agent
  slack-bot:
    build:
      context: ./slack-bot
      dockerfile: Dockerfile
    container_name: incidentfox-slack-bot
    restart: unless-stopped
    env_file:
      - .env
    environment:
      - SRE_AGENT_URL=http://sre-agent:8000
    depends_on:
      - sre-agent
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    # Cannot use read_only because app may write logs/temp files
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=100m
    volumes:
      # Mount assets read-only
      - ./slack-bot/assets:/app/assets:ro
    mem_limit: 1g
    cpus: 1
    pids_limit: 50
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    networks:
      - app_network
      - default  # Needs external access to connect to Slack

networks:
  app_network:
    driver: bridge
    internal: true  # Internal network for inter-service communication
  default:
    driver: bridge  # Default network with external access