docker-compose.yml

services:
  hookcli-mcp:
    build: .
    ports:
      - "8000:8000"
    env_file: .env
    environment:
      # Reach Docker through the restricted proxy, not the raw socket
      - DOCKER_HOST=tcp://docker-socket-proxy:2375
    depends_on:
      redis:
        condition: service_healthy
      otel-collector:
        condition: service_started
      docker-socket-proxy:
        condition: service_healthy
    networks:
      - hookcli-net

  docker-socket-proxy:
    image: ghcr.io/tecnativa/docker-socket-proxy:latest
    environment:
      # Permit only the endpoints Hook CLI MCP needs for sandbox execution
      CONTAINERS: 1   # list, inspect, create, start, stop, wait, remove
      IMAGES: 1       # list, inspect, pull (alpine:3.19)
      NETWORKS: 0
      VOLUMES: 0
      AUTH: 0
      SECRETS: 0
      POST: 1         # allow all POST (create/start/wait)
      DELETE: 1       # allow container removal
      EXEC: 0         # never allow exec into containers
      BUILD: 0        # never allow image builds via API
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    ports:
      - "127.0.0.1:2375:2375"  # bind to localhost only — not exposed externally
    networks:
      - hookcli-net
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:2375/version"]
      interval: 5s
      timeout: 3s
      retries: 5
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"
    volumes:
      - redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5
    networks:
      - hookcli-net

  otel-collector:
    image: otel/opentelemetry-collector-contrib:0.97.0
    command: ["--config=/etc/otel-collector-config.yaml"]
    volumes:
      - ./config/otel-config.yaml:/etc/otel-collector-config.yaml
    ports:
      - "4317:4317"
      - "4318:4318"
      - "8888:8888"
    networks:
      - hookcli-net

  jaeger:
    image: jaegertracing/all-in-one:1.52
    ports:
      - "16686:16686"
      - "14268:14268"
    environment:
      - COLLECTOR_OTLP_ENABLED=true
    networks:
      - hookcli-net

  prometheus:
    image: prom/prometheus:latest
    volumes:
      - ./config/prometheus.yml:/etc/prometheus/prometheus.yml
    ports:
      - "9090:9090"
    networks:
      - hookcli-net

networks:
  hookcli-net:
    driver: bridge

volumes:
  redis-data: