Omar SobhandClaude Opus 4.8
bd982943b8
Saves earlier-phase artifacts that were sitting untracked: - docs/agent-engine-architecture.md — per-tenant containerized ZeroClaw runtime decision doc (clawmates = §15 control plane; zeroclaw = per-tenant runtime). - deploy/clawmates-runtime/ — slim runtime Dockerfile, dev compose, example agent config, README (the proven Phase-1 drive recipe). - tools/runtime-spike/drive.mjs — Node WS drive client for the spike. No secrets (only env-var names / commented placeholders). Co-Authored-By: Claude Opus 4.8 <[email protected]>
43 lines
1.7 KiB
YAML
43 lines
1.7 KiB
YAML
# Clawmates per-tenant runtime — Phase 1 dev stack (gw-04)
|
|
# One tenant = one zeroclaw daemon container. Isolated on its own network so it
|
|
# cannot disturb gr33t / clawbrainhub. Gateway bound to localhost only.
|
|
#
|
|
# NOTE: provider key + gateway token are injected from Infisical at deploy time
|
|
# (do NOT commit secrets). The exact gateway-token env name is TODO (see README).
|
|
|
|
name: clawmates-dev
|
|
|
|
networks:
|
|
clawmates-net:
|
|
driver: bridge
|
|
|
|
volumes:
|
|
tenant-acme-data: {} # per-tenant /zeroclaw-data (config.toml, domain.db, brain.h5, workspace/)
|
|
|
|
services:
|
|
# The user's private multi-agent runtime (one per tenant in production).
|
|
runtime:
|
|
image: web-01:5000/clawmates-runtime:dev
|
|
container_name: clawmates-dev-runtime
|
|
command: ["daemon"]
|
|
restart: unless-stopped
|
|
networks: [clawmates-net]
|
|
ports:
|
|
- "127.0.0.1:42617:42617" # gateway, localhost-only on gw-04 (tunnel for the spike)
|
|
volumes:
|
|
- tenant-acme-data:/zeroclaw-data
|
|
environment:
|
|
ZEROCLAW_GATEWAY_PORT: "42617"
|
|
ZEROCLAW_WORKSPACE: "/zeroclaw-data/workspace"
|
|
# Provider key (from Infisical at deploy; example shape — confirm exact path):
|
|
# ZEROCLAW_providers__models__anthropic__default__api_key: "${ANTHROPIC_API_KEY}"
|
|
# Gateway auth token (env name TODO — see README):
|
|
# ZEROCLAW_GATEWAY_TOKEN: "${CLAWMATES_DEV_GATEWAY_TOKEN}"
|
|
# Hardening to add next: read-only rootfs, drop caps, no-new-privileges, mem/cpu limits.
|
|
|
|
# TODO (Phase 3): the Clawmates §15 MCP server — the single gated outbound door
|
|
# (email/slack/pay/delete/…) backed by cm-safety + cm-secrets + the audit journal.
|
|
# mcp:
|
|
# image: web-01:5000/clawmates-mcp:dev
|
|
# networks: [clawmates-net]
|