# Save alongside .env and allin-worker.seccomp.json.
name: ${ALLIN_WORKER_NAME:-allin-worker}
services:
  worker:
    image: ghcr.io/tchangang/allin-worker:0.2.0-preview.6
    pull_policy: missing
    restart: unless-stopped
    # Keep the container available for its first interactive sign-in (including Coolify Terminal).
    command:
      - sh
      - -c
      - |
        echo 'Waiting for a Claude Code or Codex account. Use the Allin installation guide to sign in.'
        until allin-worker doctor claude >/dev/null 2>&1 || allin-worker doctor codex >/dev/null 2>&1; do
          sleep 10
        done
        exec allin-worker start
    stdin_open: true
    tty: true
    environment:
      ALLIN_URL: ${ALLIN_URL:-}
      ALLIN_WORKER_API_KEY: ${ALLIN_WORKER_API_KEY:-}
      ALLIN_JOB_TIMEOUT_MS: ${ALLIN_JOB_TIMEOUT_MS:-14400000}
      ALLIN_POLL_INTERVAL_MS: ${ALLIN_POLL_INTERVAL_MS:-5000}
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
      # Dedicated worker: docker-default AppArmor blocks nested sandbox mounts.
      - apparmor=unconfined
      - seccomp=./allin-worker.seccomp.json
    stop_grace_period: 15s
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: '3'
    volumes:
      - claude-config:/home/node/.claude
      - codex-config:/home/node/.codex
      - github-config:/home/node/.config/gh
      - workspace:/workspace
volumes:
  claude-config:
  codex-config:
  github-config:
  workspace: