networks:
  executor-network:
    name: executor-network
    driver: bridge
  claw-control:
    driver: bridge
    internal: true
services:
  executor-tdx:
    restart: always
    image: ritualnetwork/executor-go:3a52ac9-3e29c37-amd64@sha256:e29995be8b50da1df7d611c7ce416137906a01287d240f6760ec27e328a0224b
    container_name: executor-tdx
    labels:
      - com.ritual.tee-type=TDX
      - com.ritual.machine-id=ritual-container
      - com.ritual.sidecar-type=executor-http-gcp-mkosi
      - com.ritual.deployment-type=gcp-mkosi
    ports:
      - 3000:3000
      - 3001:3001
      - 8082:8082
      - 3002:3002
    environment:
      - ENVIRONMENT=production
      - HOST=0.0.0.0
      - PORT=3000
      - HEALTH_PORT=3001
      - LOG_LEVEL=DEBUG
      - TEE_TYPE=TDX
      - ENCLAVE=true
      - SERVICE_ENDPOINT=${SERVICE_ENDPOINT}
      - EXECUTOR_INDEX=${EXECUTOR_INDEX}
      - PAYMENT_ADDRESS=${PAYMENT_ADDRESS}
      - CHAIN_ID=784
      - TRUSTED_READ_RPC_URL=https://34.76.33.139
      - TRUSTED_READ_WS_URL=wss://34.76.33.139
      - RPC_CERT_HASH=0x4c4dddd5049e3ac027eaea752da1de68b291a3815e621cc80b2ad22962b4f74e
      - MULTICAST_URLS=${MULTICAST_URLS}
      - PINATA_API_URL=https://api.pinata.cloud
      - PINATA_GATEWAY_URL=https://gateway.pinata.cloud/ipfs
      - IPFS_API_URL=
      - IPFS_GATEWAY_URL=
      - TEE_SERVICE_REGISTRY_CONTRACT_ADDRESS=0xf4495DC72143D44A93AB0ecE4d6D63a216b27839
      - ASYNC_JOB_TRACKER_CONTRACT_ADDRESS=0xf00385449fD961925A0B125F5f30b29B682D4bFb
      - SECRETS_ACCESS_CONTROL_CONTRACT_ADDRESS=0x0cEae62e2082829226eF5821Bb662483Db17A71F
      - AGENT_HEARTBEAT_CONTRACT_ADDRESS=0xDeeA4Df0C958966ED75570a05430BB0D4844a8cc
      - AGENT_IDENTITY_REGISTRY_CONTRACT_ADDRESS=0x2cbF50F833a3AEfb5c5B27068052cB5585F5c087
      - STREAMING_SUBMISSION=true
      - RESULT_SUBMISSION_INTERVAL=0.1
      - VALIDATOR_PREDICTION_UPDATE_INTERVAL=10
      - SKIP_ENDPOINT_VERIFICATION=false
      - JOB_PUSH_DEBUG=false
      - ALLOW_INSECURE_STREAMING=false
      - PII_ENABLED=true
      - PII_SERVICE_URL=http://pii-service:5002
      - PII_REQUEST_TIMEOUT=30
      - DKMS_ENABLED=true
      - CLAW_SPAWNER_URL=http://claw-spawner:8000
      - CLAW_SPAWNER_API_TOKEN=${CLAW_SPAWNER_API_TOKEN}
      - EXECUTOR_INTERNAL_HOSTNAME=executor-tdx
      - PERSISTENT_AGENT_MAX_INFLIGHT_REQUESTS=4
      - PERSISTENT_AGENT_SPAWN_QUEUE_DEPTH=16
      - PERSISTENT_AGENT_SPAWN_QUEUE_WAIT_TIMEOUT_SECONDS=60
      - PERSISTENT_AGENT_SPAWN_HTTP_TIMEOUT_SECONDS=900
      - OPERATOR_TOKEN=${EXECUTOR_OPERATOR_TOKEN}
      - SERVICE_ROUTES_JSON=${EXECUTOR_SERVICE_ROUTES_JSON}
      - SERVICE_ROUTES_FILE=/operator-routes/routes.json
      - OPERATOR_LISTEN_ADDR=0.0.0.0:3002
      - OPERATOR_TLS=true
      - MCP_TELEMETRY_RELAY_UPSTREAM=https://34.153.216.168:8088/v1/mcp/events
    volumes:
      - /dev/tdx_guest:/dev/tdx_guest:rw
      - /sys/kernel/config:/sys/kernel/config:rw
      - /etc/tdx-attest.conf:/etc/tdx-attest.conf:ro
      - /sys/firmware/acpi/tables/data/CCEL:/sys/firmware/acpi/tables/data/CCEL:ro
      - operator-routes:/operator-routes
    devices:
      - /dev/tdx_guest:/dev/tdx_guest
      - /dev/tpm0:/dev/tpm0
      - /dev/tpmrm0:/dev/tpmrm0
    privileged: true
    security_opt:
      - seccomp:unconfined
    healthcheck:
      test:
        - CMD
        - curl
        - -fsS
        - http://localhost:3001/healthz
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s
    networks:
      - executor-network
    depends_on:
      pii-service:
        condition: service_healthy
      claw-spawner:
        condition: service_started
  pii-service:
    restart: always
    logging:
      driver: json-file
      options:
        max-size: 50m
        max-file: '3'
    image: ritualnetwork/ritual-pii:3a52ac9-3e29c37-amd64@sha256:b1c226fc469dc1e7305d8c1835c58fc70fc7a89c459c435dd8fde98266092e87
    container_name: pii-service
    command:
      - uvicorn
      - api:app
      - --host
      - 0.0.0.0
      - --port
      - '5002'
      - --workers
      - '4'
    ports:
      - 5002:5002
    environment:
      - LOG_LEVEL=INFO
    healthcheck:
      test:
        - CMD
        - python
        - -c
        - import urllib.request; urllib.request.urlopen('http://localhost:5002/health')
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s
    networks:
      - executor-network
  docker-socket-proxy:
    image: ritualnetwork/docker-socket-proxy:v0.4.2-2f04313-d2e4bd3-amd64@sha256:3bff20a073dd73cdd80ebdec3c55244a460b097fcfd00eab98515d5df6d10568
    container_name: docker-socket-proxy
    restart: unless-stopped
    logging:
      driver: json-file
      options:
        max-size: 100m
        max-file: '1'
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - CONTAINERS=1
      - NETWORKS=1
      - POST=1
      - IMAGES=0
      - VOLUMES=0
      - EXEC=1
      - AUTH=0
      - SECRETS=0
      - SWARM=0
      - BUILD=0
    networks:
      - claw-control
  claw-spawner:
    image: ritualnetwork/claw-spawner:d2e4bd3-amd64@sha256:22bbc5d991e34c9f278223cc83c1351dd48c2529354c4ba7789662229e7d2e5e
    container_name: claw-spawner
    restart: unless-stopped
    depends_on:
      - docker-socket-proxy
    logging:
      driver: json-file
      options:
        max-size: 1g
        max-file: '1'
    ports:
      - 127.0.0.1:8123:8000
    volumes:
      - /var/log/claw-spawner:/var/log/claw-spawner
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    environment:
      - DOCKER_HOST=tcp://docker-socket-proxy:2375
      - SPAWNER_API_TOKEN=${CLAW_SPAWNER_API_TOKEN}
      - PINATA_API_URL=https://api.pinata.cloud
      - PINATA_GATEWAY_URL=https://gateway.pinata.cloud/ipfs
      - IPFS_API_URL=
      - IPFS_GATEWAY_URL=
      - SPAWNER_HOST=0.0.0.0
      - SPAWNER_PORT=8000
      - SPAWNER_INTERNAL_URL=http://claw-spawner:8000
      - OPENCLAW_IMAGE=ritualnetwork/zeroclaw-instance:502b5f2-d2e4bd3-amd64@sha256:435b210f1a4b198f834bfa4fe2954941550bdc88ce245fba893d0cb016cc889d
      - AGENT_INSTANCE_IMAGE=ritualnetwork/zeroclaw-instance:502b5f2-d2e4bd3-amd64@sha256:435b210f1a4b198f834bfa4fe2954941550bdc88ce245fba893d0cb016cc889d
      - AGENT_RUNTIME_IMAGES={"1":"ritualnetwork/openclaw-instance:d2e4bd3-amd64@sha256:0e2080147396485588789c99e479f720430778a102a16e353e9ca87d3efc1600","2":"ritualnetwork/hermes-instance:30eff89-d2e4bd3-amd64@sha256:82c4d4957698f139221c21fce2f6e91148ead2b5f63ffab54ca53644c702d063"}
      - EXEC_CONTAINER_DEFAULT_IMAGE=ritualnetwork/sovereign-agent:d2e4bd3-amd64@sha256:e557f1301e8cc2785bff436604300cef1576f510226ca64b918eb54a79e03ec7
      - DOCKER_NETWORK=executor-network
      - AGENT_INTERNAL_SERVICE_CONTAINERS={}
      - AGENT_EXECUTOR_SERVICE_CONTAINERS={"executor-tdx":"executor-tdx"}
      - PORT_RANGE_START=18790
      - PORT_RANGE_END=18890
      - INSTANCE_RESTART_POLICY=no
      - LOCAL_DEV_MODE=false
      - MAX_EXEC_CONTAINERS=500
      - DA_SYNC_MAX_FILE_BYTES=67108864
      - DA_SYNC_MAX_BYTES=268435456
      - DA_SYNC_MAX_FILES=500
      - DA_SYNC_CRITICAL_FILE_MAX_BYTES=2147483648
      - DA_SYNC_WORKSPACE_MAX_FILES=200
      - DA_SYNC_WORKSPACE_MAX_BYTES=104857600
      - RESTORE_MAX_CONCURRENT_DOWNLOADS=4
      - RESTORE_MAX_MANIFEST_BYTES=4194304
      - AGENT_INSTANCE_MEMORY_RESERVATION=1g
      - AGENT_STARTUP_MEMORY_LIMIT=1280m
      - AGENT_STEADY_MEMORY_LIMIT=1280m
      - AGENT_MEMORY_STABILIZATION_DELAY_SECONDS=60
      - AGENT_MEMORY_TRANSITION_RETRY_DELAY_SECONDS=30
      - AGENT_STEADY_MEMORY_HEADROOM=512m
      - AGENT_SIDECAR_GOMEMLIMIT=1GiB
      - MAX_PERSISTENT_AGENTS_PER_NODE=8
      - MAX_CONCURRENT_AGENT_STARTS=1
      - AGENT_LIMIT_BUDGET=10g
      - AGENT_HOST_MEMORY_RESERVE=2g
      - AGENT_START_QUEUE_TIMEOUT_SECONDS=120
      - AGENT_CAPACITY_RECHECK_INTERVAL_SECONDS=1
      - HERMES_SESSION_RETENTION_DAYS=30
      - DEAD_CONTAINER_LOG_DIR=/var/log/claw-spawner/agent-exits
      - DEAD_CONTAINER_LOG_TAIL_LINES=400
      - AGENT_HEARTBEAT_CONTRACT_ADDRESS=0xDeeA4Df0C958966ED75570a05430BB0D4844a8cc
      - MULTICAST_URLS=${MULTICAST_URLS}
      - TRUSTED_READ_RPC_URL=https://34.76.33.139
      - TRUSTED_READ_WS_URL=wss://34.76.33.139
      - RPC_CERT_HASH=0x4c4dddd5049e3ac027eaea752da1de68b291a3815e621cc80b2ad22962b4f74e
      - RITUAL_WALLET_CONTRACT_ADDRESS=0xF04076756d8129Baec46Dc0F1c526Baec490C393
    networks:
      - executor-network
      - claw-control
  prepull-runtime-0:
    image: ritualnetwork/hermes-instance:30eff89-d2e4bd3-amd64@sha256:82c4d4957698f139221c21fce2f6e91148ead2b5f63ffab54ca53644c702d063
    restart: 'no'
    entrypoint:
      - 'true'
    network_mode: none
  prepull-runtime-1:
    image: ritualnetwork/openclaw-instance:d2e4bd3-amd64@sha256:0e2080147396485588789c99e479f720430778a102a16e353e9ca87d3efc1600
    restart: 'no'
    entrypoint:
      - 'true'
    network_mode: none
  prepull-runtime-2:
    image: ritualnetwork/sovereign-agent:d2e4bd3-amd64@sha256:e557f1301e8cc2785bff436604300cef1576f510226ca64b918eb54a79e03ec7
    restart: 'no'
    entrypoint:
      - 'true'
    network_mode: none
  prepull-runtime-3:
    image: ritualnetwork/zeroclaw-instance:502b5f2-d2e4bd3-amd64@sha256:435b210f1a4b198f834bfa4fe2954941550bdc88ce245fba893d0cb016cc889d
    restart: 'no'
    entrypoint:
      - 'true'
    network_mode: none
volumes:
  operator-routes: {}
