docker-compose.yml

name: mirror-neuron

services:
  redis:
    image: redis:8
    container_name: mirror-neuron-redis
    restart: unless-stopped
    expose:
      - "6379"
    environment:
      MN_REDIS_PASSWORD: ${MN_REDIS_PASSWORD:-}
    command: >
      sh -c 'if [ -n "$$MN_REDIS_PASSWORD" ]; then
      exec redis-server --appendonly yes --requirepass "$$MN_REDIS_PASSWORD" --masterauth "$$MN_REDIS_PASSWORD";
      else
      exec redis-server --appendonly yes;
      fi'
    volumes:
      - redis-data:/data
    networks:
      runtime:
        aliases:
          - redis
          - ${MN_NODE_ALIAS:-mirror-neuron}-redis

  syncthing:
    image: ${MN_SYNCTHING_IMAGE:-syncthing/syncthing:latest}
    container_name: mirror-neuron-syncthing
    profiles:
      - syncthing
    restart: unless-stopped
    user: "0:0"
    entrypoint:
      - /bin/sh
      - -ec
      - |
        set -eu
        config_dir="$${STHOMEDIR:-/var/syncthing/config}"
        config_file="$$config_dir/config.xml"
        mkdir -p "$$config_dir"

        if [ ! -f "$$config_file" ]; then
          /bin/syncthing generate --home "$$config_dir" --no-port-probing
        fi

        sed -i \
          -e 's#<relaysEnabled>[^<]*</relaysEnabled>#<relaysEnabled>false</relaysEnabled>#' \
          -e 's#<globalAnnounceEnabled>[^<]*</globalAnnounceEnabled>#<globalAnnounceEnabled>false</globalAnnounceEnabled>#' \
          -e 's#<natEnabled>[^<]*</natEnabled>#<natEnabled>false</natEnabled>#' \
          -e 's#<localAnnounceEnabled>[^<]*</localAnnounceEnabled>#<localAnnounceEnabled>true</localAnnounceEnabled>#' \
          -e 's#<stunKeepaliveStartS>[^<]*</stunKeepaliveStartS>#<stunKeepaliveStartS>0</stunKeepaliveStartS>#' \
          -e 's#<urAccepted>[^<]*</urAccepted>#<urAccepted>-1</urAccepted>#' \
          -e 's#<autoUpgradeIntervalH>[^<]*</autoUpgradeIntervalH>#<autoUpgradeIntervalH>0</autoUpgradeIntervalH>#' \
          -e 's#<crashReportingEnabled>[^<]*</crashReportingEnabled>#<crashReportingEnabled>false</crashReportingEnabled>#' \
          "$$config_file"

        # The policy setup above runs as root, while the image entrypoint
        # drops to PUID:PGID before starting Syncthing.  Hand the complete
        # generated configuration back to that runtime user so certificate
        # rotation and config updates work on bind mounts as well.
        chown -R "$${PUID:-1000}:$${PGID:-1000}" "$$config_dir"

        exec /bin/entrypoint.sh /bin/syncthing serve
    environment:
      STGUIADDRESS: 0.0.0.0:8384
      STGUIAPIKEY: ${MN_SYNCTHING_API_KEY:-}
      STHOMEDIR: /var/syncthing/config
      MN_SYNCTHING_LAN_ONLY: "1"
      MN_HOST_SHARED_STORAGE_ROOT: ${MN_HOST_SHARED_STORAGE_ROOT:-${MN_SHARED_STORAGE_ROOT:-./mn/shared}}
      MN_SYNCTHING_API_KEY: ${MN_SYNCTHING_API_KEY:-}
    ports:
      - "${MN_SYNCTHING_BIND_HOST:-0.0.0.0}:${MN_SYNCTHING_GUI_PORT:-58384}:8384/tcp"
      - "${MN_SYNCTHING_BIND_HOST:-0.0.0.0}:${MN_SYNCTHING_SYNC_PORT:-22000}:22000/tcp"
    volumes:
      - ${MN_HOST_HOME_DIR:-./mn}/syncthing:/var/syncthing/config:rw
      - ${MN_HOST_SHARED_STORAGE_ROOT:-${MN_SHARED_STORAGE_ROOT:-./mn/shared}}:${MN_SYNCTHING_FOLDER_PATH:-/var/syncthing/MirrorNeuronShared}:rw
    networks:
      - runtime

  openshell:
    image: ${OPENSHELL_GATEWAY_IMAGE:-ghcr.io/nvidia/openshell/gateway:0.0.47}
    container_name: openshell-cluster-openshell
    command: ["--bind-address", "0.0.0.0", "--port", "${OPENSHELL_GATEWAY_PORT:-58080}"]
    user: "${OPENSHELL_GATEWAY_USER:-1000:1000}"
    group_add:
      - "${OPENSHELL_GATEWAY_DOCKER_GROUP:-0}"
    profiles:
      - openshell
    restart: unless-stopped
    expose:
      - "${OPENSHELL_GATEWAY_PORT:-58080}"
    environment:
      HOME: ${MN_HOST_OPENSHELL_STATE_DIR:-./openshell-state}
      XDG_DATA_HOME: ${MN_HOST_OPENSHELL_STATE_DIR:-./openshell-state}/.local/share
      OPENSHELL_GATEWAY_CONFIG: ${MN_HOST_OPENSHELL_STATE_DIR:-./openshell-state}/gateway.toml
      OPENSHELL_DRIVERS: docker
      OPENSHELL_DB_URL: "sqlite:${MN_HOST_OPENSHELL_STATE_DIR:-./openshell-state}/openshell.db"
      OPENSHELL_DISABLE_TLS: "true"
      OPENSHELL_BIND_ADDRESS: 0.0.0.0
      OPENSHELL_SERVER_PORT: ${OPENSHELL_GATEWAY_PORT:-58080}
    volumes:
      - ${MN_HOST_OPENSHELL_STATE_DIR:-./openshell-state}:${MN_HOST_OPENSHELL_STATE_DIR:-./openshell-state}
      - ${DOCKER_HOST_SOCKET:-/var/run/docker.sock}:/var/run/docker.sock
    networks:
      - runtime

  membrane-context-engine:
    image: ${ENGINE_IMAGE:-mirror-neuron-memory-engine:latest}
    container_name: mirror-neuron-context-engine
    profiles:
      - context
    build:
      context: ${MEMBRANE_DIR:-../Membrane}
      dockerfile: Dockerfile
      target: runtime
    restart: unless-stopped
    expose:
      - "50052"
    environment:
      MN_CONTEXT_ADDR: 0.0.0.0:50052
      MN_CONTEXT_REDIS_URL: ${MN_CONTEXT_REDIS_URL:-redis://redis:6379/1}
      MN_CONTEXT_DEBUG: ${MN_CONTEXT_DEBUG:-0}
      MN_CONTEXT_DEBUG_DETAIL: ${MN_CONTEXT_DEBUG_DETAIL:-basic}
      MN_CONTEXT_DEBUG_DIR: /tmp/mn-context-engine/context-views
      MN_CONTEXT_MODEL_COMPRESSION_ENABLED: ${MN_CONTEXT_MODEL_COMPRESSION_ENABLED:-true}
      MN_CONTEXT_COMPRESSION_COMMAND: /usr/local/bin/mn_context_model_client.py
      MN_CONTEXT_MODEL_ENDPOINT: ${MN_CONTEXT_MODEL_ENDPOINT:-http://model-runner.docker.internal/engines/v1}
      MN_CONTEXT_MODEL_NAME: ${MN_CONTEXT_MODEL_NAME:-${MN_CONTEXT_MODEL_RUNNER_MODEL:-hf.co/homerquan/mn-context-engine-model-v-Q4_K_M}}
      MN_CONTEXT_MODEL_TIMEOUT_SECONDS: ${MN_CONTEXT_MODEL_TIMEOUT_SECONDS:-300}
    depends_on:
      redis:
        condition: service_started
    volumes:
      - context-debug:/tmp/mn-context-engine
    networks:
      - runtime

  mn-litellm-proxy:
    image: mirror-neuron-core:latest
    container_name: mn-litellm-proxy
    restart: unless-stopped
    command: >
      sh -c 'mkdir -p /root/.mn/models/litellm-gateway;
      test -f /root/.mn/models/litellm-gateway/config.yaml ||
      printf "{\"model_list\":[]}\n" > /root/.mn/models/litellm-gateway/config.yaml;
      if command -v litellm >/dev/null 2>&1; then runner=litellm; else runner="python3 -m litellm"; fi;
      exec $$runner --config /root/.mn/models/litellm-gateway/config.yaml --host 0.0.0.0 --port 4000'
    expose:
      - "4000"
    ports:
      - "${MN_LITELLM_GATEWAY_BIND_HOST:-127.0.0.1}:${MN_LITELLM_GATEWAY_PORT:-4000}:4000"
    env_file:
      - path: ${MN_LITELLM_GATEWAY_ENV_FILE:-./docker-compose.env}
        required: false
    environment:
      HOME: /root
      MN_LITELLM_GATEWAY_INTERNAL_API_BASE: ${MN_LITELLM_GATEWAY_INTERNAL_API_BASE:-http://mn-litellm-proxy:4000/v1}
      MN_LITELLM_MAX_CONCURRENT_REQUESTS: ${MN_LITELLM_MAX_CONCURRENT_REQUESTS:-1}
      MN_LITELLM_MAX_CONCURRENT_EMBEDDINGS: ${MN_LITELLM_MAX_CONCURRENT_EMBEDDINGS:-1}
      MN_LITELLM_MAX_QUEUED_REQUESTS: ${MN_LITELLM_MAX_QUEUED_REQUESTS:-64}
      MN_LITELLM_QUEUE_TIMEOUT_SECONDS: ${MN_LITELLM_QUEUE_TIMEOUT_SECONDS:-1800}
      MN_LITELLM_MAX_SLOT_SECONDS: ${MN_LITELLM_MAX_SLOT_SECONDS:-3600}
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:4000/v1/models >/dev/null || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 20s
    volumes:
      - ${MN_HOST_HOME_DIR:-./mn}:/root/.mn
      - ${MN_HOST_HOME_DIR:-./mn}:/opt/mirror_neuron/.mn
    extra_hosts:
      - "host.docker.internal:host-gateway"
    networks:
      runtime:
        aliases:
          - mn-litellm-proxy

  mirror-neuron-core:
    image: mirror-neuron-core:latest
    container_name: mirror-neuron-core
    restart: unless-stopped
    expose:
      - "50051"
      - "${MN_EPMD_PORT:-54369}"
      - "${MN_DIST_PORT:-54370}"
    ports:
      - "${MN_GRPC_BIND_HOST:-127.0.0.1}:${MN_GRPC_PORT:-55051}:50051"
    command: >
      sh -c 'if [ -n "$$MN_NODE_NAME" ]; then
      if [ -z "$$MN_COOKIE" ] || [ "$$MN_COOKIE" = "mirrorneuron" ]; then
      echo "MN_COOKIE must be set to a non-default secret when MN_NODE_NAME enables distributed Erlang" >&2; exit 1;
      fi;
      dist_port="$${MN_DIST_PORT:-4370}";
      unset ERL_EPMD_ADDRESS;
      epmd -daemon;
      exec elixir --name "$$MN_NODE_NAME" --cookie "$$MN_COOKIE" --erl "-kernel inet_dist_listen_min $${dist_port} inet_dist_listen_max $${dist_port}" -S mix run --no-halt;
      else exec mix run --no-halt; fi'
    environment:
      HOME: /root
      MN_CORE_HOST: 0.0.0.0
      MN_REDIS_HOST: redis
      MN_REDIS_URL: ${MN_REDIS_URL:-redis://redis:6379/0}
      MN_REDIS_HA_MODE: ${MN_REDIS_HA_MODE:-single}
      MN_REDIS_SENTINELS: ${MN_REDIS_SENTINELS:-}
      MN_REDIS_SENTINEL_MASTER: ${MN_REDIS_SENTINEL_MASTER:-mirror-neuron}
      MN_REDIS_SENTINEL_HOST_MAP: ${MN_REDIS_SENTINEL_HOST_MAP:-}
      MN_REDIS_DB: ${MN_REDIS_DB:-0}
      MN_REDIS_USERNAME: ${MN_REDIS_USERNAME:-}
      MN_REDIS_PASSWORD: ${MN_REDIS_PASSWORD:-}
      MN_REDIS_SENTINEL_USERNAME: ${MN_REDIS_SENTINEL_USERNAME:-}
      MN_REDIS_SENTINEL_PASSWORD: ${MN_REDIS_SENTINEL_PASSWORD:-}
      MN_REDIS_WAIT_REPLICAS: ${MN_REDIS_WAIT_REPLICAS:-0}
      MN_REDIS_WAIT_TIMEOUT_MS: ${MN_REDIS_WAIT_TIMEOUT_MS:-100}
      MN_REDIS_RECONNECT_ATTEMPTS: ${MN_REDIS_RECONNECT_ATTEMPTS:-10}
      MN_REDIS_RECONNECT_BACKOFF_MS: ${MN_REDIS_RECONNECT_BACKOFF_MS:-250}
      MN_REDIS_RECONNECT_MAX_BACKOFF_MS: ${MN_REDIS_RECONNECT_MAX_BACKOFF_MS:-2000}
      MN_NETWORK_JOIN_TOKEN: ${MN_NETWORK_JOIN_TOKEN:-}
      MN_NETWORK_ADVERTISE_HOST: ${MN_NETWORK_ADVERTISE_HOST:-}
      MN_MODEL_SERVICE_NODE_NAME: ${MN_MODEL_SERVICE_NODE_NAME:-}
      MN_NETWORK_REDIS_HOST: ${MN_NETWORK_REDIS_HOST:-}
      MN_NETWORK_REDIS_PORT: ${MN_NETWORK_REDIS_PORT:-}
      MN_CONTEXT_ADDR: membrane-context-engine:50052
      MN_EXECUTOR_MAX_CONCURRENCY: ${MN_EXECUTOR_MAX_CONCURRENCY:-50}
      MN_NODE_ALIAS: ${MN_NODE_ALIAS:-}
      MN_DOCKER_NETWORK_MODE: ${MN_DOCKER_NETWORK_MODE:-}
      MN_DOCKER_NETWORK_NAME: ${MN_DOCKER_NETWORK_NAME:-}
      MN_NODE_NAME: ${MN_NODE_NAME:-}
      MN_NODE_ROLE: ${MN_NODE_ROLE:-runtime}
      MN_NODE_HARDWARE_JSON: ${MN_NODE_HARDWARE_JSON:-}
      MN_NODE_DISPLAY_NAME: ${MN_NODE_DISPLAY_NAME:-}
      MN_NODE_CPU_CORES: ${MN_NODE_CPU_CORES:-}
      MN_NODE_CPU_MODEL: ${MN_NODE_CPU_MODEL:-}
      MN_NODE_MEMORY_TOTAL_MB: ${MN_NODE_MEMORY_TOTAL_MB:-}
      MN_NODE_MEMORY_AVAILABLE_MB: ${MN_NODE_MEMORY_AVAILABLE_MB:-}
      MN_NODE_DISK_TOTAL_MB: ${MN_NODE_DISK_TOTAL_MB:-}
      MN_NODE_DISK_AVAILABLE_MB: ${MN_NODE_DISK_AVAILABLE_MB:-}
      MN_NODE_HOST_PATHS: ${MN_NODE_HOST_PATHS:-}
      MN_NODE_RUNTIME_DRIVERS: ${MN_NODE_RUNTIME_DRIVERS:-}
      MN_NODE_GPU: ${MN_NODE_GPU:-}
      MN_NODE_GPU_COUNT: ${MN_NODE_GPU_COUNT:-}
      MN_NODE_GPU_VENDOR: ${MN_NODE_GPU_VENDOR:-}
      MN_NODE_GPU_DRIVER: ${MN_NODE_GPU_DRIVER:-}
      MN_NODE_GPU_TYPE: ${MN_NODE_GPU_TYPE:-}
      MN_NODE_GPU_NAME: ${MN_NODE_GPU_NAME:-}
      MN_NODE_GPU_API_VERSION: ${MN_NODE_GPU_API_VERSION:-}
      MN_NODE_GPU_DRIVER_VERSION: ${MN_NODE_GPU_DRIVER_VERSION:-}
      MN_NODE_GPU_MEMORY_TOTAL_MB: ${MN_NODE_GPU_MEMORY_TOTAL_MB:-}
      MN_NODE_GPU_MEMORY_FREE_MB: ${MN_NODE_GPU_MEMORY_FREE_MB:-}
      MN_NODE_GPU_MEMORY_USED_MB: ${MN_NODE_GPU_MEMORY_USED_MB:-}
      MN_NODE_GPU_SHARED_MEMORY: ${MN_NODE_GPU_SHARED_MEMORY:-}
      MN_NODE_GPU_INTEGRATED: ${MN_NODE_GPU_INTEGRATED:-}
      MN_NODE_GPU_UNIFIED_MEMORY: ${MN_NODE_GPU_UNIFIED_MEMORY:-}
      MN_NODE_GPU_UNIFIED_MEMORY_MB: ${MN_NODE_GPU_UNIFIED_MEMORY_MB:-}
      MN_NODE_MODELS: ${MN_NODE_MODELS:-}
      MN_NODE_RUNTIME_MODELS: ${MN_NODE_RUNTIME_MODELS:-}
      MN_CLUSTER_NODES: ${MN_CLUSTER_NODES:-}
      MN_DIST_PORT: ${MN_DIST_PORT:-54370}
      MN_BLOB_STORE_ROOT: ${MN_CONTAINER_BLOB_STORE_ROOT:-/root/.mn/shared/blobs}
      MN_JOB_ARTIFACT_ROOT: ${MN_CONTAINER_JOB_ARTIFACT_ROOT:-/root/.mn/shared/jobs}
      MN_RUNS_ROOT: ${MN_CONTAINER_RUNS_ROOT:-/root/.mn/runs}
      MN_SHARED_STORAGE_ROOT: ${MN_RUNTIME_SHARED_STORAGE_ROOT:-${MN_CONTAINER_SHARED_STORAGE_ROOT:-/root/.mn/shared}}
      MN_HOST_SHARED_STORAGE_ROOT: ${MN_HOST_SHARED_STORAGE_ROOT:-${MN_SHARED_STORAGE_ROOT:-./mn/shared}}
      MN_RUNTIME_SHARED_STORAGE_ROOT: ${MN_RUNTIME_SHARED_STORAGE_ROOT:-${MN_CONTAINER_SHARED_STORAGE_ROOT:-/root/.mn/shared}}
      MN_BUNDLE_CACHE_DIR: ${MN_BUNDLE_CACHE_DIR:-${MN_RUNTIME_SHARED_STORAGE_ROOT:-${MN_CONTAINER_SHARED_STORAGE_ROOT:-/root/.mn/shared}}/bundle_cache}
      MN_BLUEPRINT_PYTHON_ENVS_DIR: ${MN_CONTAINER_BLUEPRINT_PYTHON_ENVS_DIR:-}
      MN_SYNCTHING_ENABLED: ${MN_SYNCTHING_ENABLED:-auto}
      MN_SYNCTHING_API_KEY: ${MN_SYNCTHING_API_KEY:-}
      MN_SYNCTHING_DEVICE_ID: ${MN_SYNCTHING_DEVICE_ID:-}
      MN_SYNCTHING_ADVERTISE_HOST: ${MN_SYNCTHING_ADVERTISE_HOST:-}
      MN_SYNCTHING_GUI_PORT: ${MN_SYNCTHING_GUI_PORT:-58384}
      MN_SYNCTHING_SYNC_PORT: ${MN_SYNCTHING_SYNC_PORT:-22000}
      MN_SYNCTHING_RESCAN_INTERVAL_SECONDS: ${MN_SYNCTHING_RESCAN_INTERVAL_SECONDS:-3600}
      MN_SYNCTHING_FOLDER_ID: ${MN_SYNCTHING_FOLDER_ID:-mirror-neuron-shared}
      MN_SYNCTHING_FOLDER_PATH: ${MN_SYNCTHING_FOLDER_PATH:-/var/syncthing/MirrorNeuronShared}
      MN_BLUEPRINT_WEB_UI_BIND_HOST: ${MN_BLUEPRINT_WEB_UI_BIND_HOST:-0.0.0.0}
      MN_BLUEPRINT_WEB_UI_PUBLIC_HOST: ${MN_BLUEPRINT_WEB_UI_PUBLIC_HOST:-localhost}
      MN_BLUEPRINT_WEB_UI_PORT_START: ${MN_BLUEPRINT_WEB_UI_PORT_START:-58000}
      MN_BLUEPRINT_WEB_UI_PORT_END: ${MN_BLUEPRINT_WEB_UI_PORT_END:-58049}
      ERL_EPMD_PORT: ${MN_EPMD_PORT:-54369}
      ERL_EPMD_ADDRESS: ${ERL_EPMD_ADDRESS:-0.0.0.0}
      ERL_AFLAGS: ${ERL_AFLAGS:-}
      MN_COOKIE: ${MN_COOKIE:-}
      MN_GRPC_AUTH_TOKEN: mirror_neuron_password
      SLACK_BOT_TOKEN: ${SLACK_BOT_TOKEN:-}
      SLACK_DEFAULT_CHANNEL: ${SLACK_DEFAULT_CHANNEL:-}
      SLACK_API_BASE_URL: ${SLACK_API_BASE_URL:-}
      MN_SLACK_BOT_TOKEN: ${MN_SLACK_BOT_TOKEN:-}
      MN_SLACK_DEFAULT_CHANNEL: ${MN_SLACK_DEFAULT_CHANNEL:-}
      MN_SLACK_API_BASE_URL: ${MN_SLACK_API_BASE_URL:-}
    depends_on:
      redis:
        condition: service_started
    volumes:
      - ${MN_HOST_HOME_DIR:-./mn}:/root/.mn
      - ${MN_HOST_HOME_DIR:-./mn}:/opt/mirror_neuron/.mn
      - ${MN_HOST_ARTIFACTS_DIR:-./mn/runs}:/root/.mn/runs
      - ${MN_HOST_ARTIFACTS_DIR:-./mn/runs}:/opt/mirror_neuron/.mn/runs
      - ${MN_HOST_SHARED_STORAGE_ROOT:-${MN_SHARED_STORAGE_ROOT:-./mn/shared}}:${MN_RUNTIME_SHARED_STORAGE_ROOT:-${MN_CONTAINER_SHARED_STORAGE_ROOT:-/root/.mn/shared}}
      - ${MN_HOST_SHARED_STORAGE_ROOT:-${MN_SHARED_STORAGE_ROOT:-./mn/shared}}:/opt/mirror_neuron/.mn/shared
      - ${MN_HOST_OPENSHELL_CONFIG_DIR:-./openshell-config}:/root/.config/openshell:ro
      - ${MN_HOST_OPENSHELL_CONFIG_DIR:-./openshell-config}:/opt/mirror_neuron/.config/openshell:ro
    networks:
      runtime:
        aliases:
          - ${MN_NODE_ALIAS:-mirror-neuron-core}

networks:
  runtime:
    name: ${MN_DOCKER_NETWORK_NAME:-mirror-neuron-runtime}
    external: ${MN_DOCKER_NETWORK_EXTERNAL:-false}
    driver: ${MN_DOCKER_NETWORK_DRIVER:-bridge}
    attachable: ${MN_DOCKER_NETWORK_ATTACHABLE:-false}

volumes:
  redis-data:
  context-debug: