docker-compose.yml

version: '3.8'

services:
  # Redis for actor state management
  redis:
    image: redis:7-alpine
    ports:
      - "6379:6379"
    volumes:
      - redis-data:/data
    command: redis-server --appendonly yes
    networks:
      - reflow-network

  # MicroSandbox server for secure script execution
  microsandbox:
    build:
      context: ./docker/microsandbox
      dockerfile: Dockerfile
    ports:
      - "8080:8080"  # MicroSandbox server API
    environment:
      MSB_PORT: 8080
      MSB_HOST: 0.0.0.0
      RUST_LOG: info
    volumes:
      - ./docker/microsandbox/scripts:/var/lib/microsandbox/scripts:ro
      - microsandbox-data:/root/.msb  # Persist sandbox data
      - /var/run/docker.sock:/var/run/docker.sock  # Allow Docker access for sandbox creation
    privileged: true  # Required for MicroSandbox VM isolation
    cap_add:
      - SYS_ADMIN  # Required for sandbox operations
      - NET_ADMIN  # Required for network isolation
    networks:
      - reflow-network
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: 4G
        reservations:
          cpus: '1'
          memory: 2G


networks:
  reflow-network:
    driver: bridge

volumes:
  redis-data:
  microsandbox-data: