docker-compose.yml

services:
  devbox-base:
    profiles: [donotstart]
    image: predkambrij/devbox_${COMPOSE_PROJECT_NAME}:latest
    pull_policy: never
    build:
      context: .
      network: host
      dockerfile_inline: |
        FROM debian:13

        ENV DEBIAN_FRONTEND noninteractive

        ARG ARG_UID
        ARG ARG_GID
        ARG ARG_UNAME
        ARG ARG_GNAME
        ARG ARG_DOCKER_GID

        COPY .assets/build_as_root.sh /
        RUN /build_as_root.sh prepareUser

        USER ${ARG_UNAME}
        COPY .assets/build_as_user.sh /
        RUN /build_as_user.sh aptUpdate && \
            /build_as_user.sh installSomeSw && \
            /build_as_user.sh installMoreSw && \
            /build_as_user.sh installDockerClient

        ENV SSHD_PORT=22
        USER root
        COPY .assets/supervisord.conf /etc/

        # Save environment for SSH sessions and prepare the user runtime directory before starting services.
        ENTRYPOINT ["/bin/bash", "-c", \
          "env | grep -vE 'PATH|HOSTNAME|PWD|HOME|SHLVL|^_=' >> /etc/environment; \
          \
          mkdir -p /run/user/${ARG_UID} && \
          chmod 700 /run/user/${ARG_UID} && \
          chown ${ARG_UID}:${ARG_GID} /run/user/${ARG_UID}; \
          \
          exec /usr/bin/supervisord -n -c /etc/supervisord.conf"]
      args:
        ARG_DOCKER_GID: ${ARG_DOCKER_GID}
        ARG_UID: ${ARG_UID}
        ARG_GID: ${ARG_GID}
        ARG_UNAME: ${ARG_UNAME}
        ARG_GNAME: ${ARG_GNAME}
    networks:
      - network
    extra_hosts:
      - "${DEVBOX_HOSTNAME}:127.0.0.1"
      - "${DEVBOX_HOSTNAME}.localdomain:127.0.0.1"
    hostname: "${DEVBOX_HOSTNAME}.localdomain"
    environment:
      - DISPLAY
      - PULSE_SERVER=unix:${XDG_RUNTIME_DIR}/pulse/native
    env_file:
      - .env
      - .env.extra
    configs:
      - source: set_etc_environment
        target: /usr/local/bin/set_etc_environment.sh
    entrypoint: ["bash", "/usr/local/bin/set_etc_environment.sh", "/usr/bin/supervisord", "-n", "-c", "/etc/supervisord.conf"]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /tmp/.X11-unix:/tmp/.X11-unix
      - /dev/shm:/dev/shm
      - /run/dbus/:/run/dbus/
      - ~/.Xauthority:/home/${ARG_UNAME}/.Xauthority
      - ${DEVBOX_ROOT}:/build/
      - homeuser:/home/${ARG_UNAME}
      - ${XDG_RUNTIME_DIR}/pulse:${XDG_RUNTIME_DIR}/pulse
      - /run/user/${ARG_UID}:/run/user/${ARG_UID}
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - ~/.codex/auth.json:/home/${ARG_UNAME}/.codex/auth.json:ro
    logging:
      driver: json-file
      options:
        max-size: "100m"
    #privileged: true
    #deploy:
    #  resources:
    #    reservations:
    #      devices:
    #        - driver: nvidia
    #          count: all # 1 # alternatively, use `count: all` for all GPUs
    #          capabilities: [gpu, graphics, video, compute, utility, display]

  devbox-ports:
    extends:
      service: devbox-base
    ports:
      - "2022:22"

  devbox-host:
    extends:
      service: devbox-base
    networks: !reset []
    network_mode: host
    environment:
      - SSHD_PORT=2022

  devbox:
    extends:
      service: ${DEVBOX_CONFIG:-devbox-base}
    profiles: !reset []

volumes:
  homeuser:

networks:
  network:
    name: "${NETWORK_NAME}"
    external: true


configs:
  set_etc_environment:
    # Escape $ so Bash expands variables at container startup.
    content: |
      #!/usr/bin/env bash
      set -euo pipefail

      source /build/conf.sh

      for var_name in "$${EXTRA_ENV_KEYS[@]}"; do
        grep -q "^$${var_name}=" /etc/environment || echo "$${var_name}=$${!var_name-}" >> /etc/environment
      done

      # Set up user runtime directory
      if [[ -n "$${ARG_UID:-}" ]]; then
        mkdir -p "/run/user/$${ARG_UID}"
        chmod 700 "/run/user/$${ARG_UID}"
        chown "$${ARG_UID}:$${ARG_GID:-$${ARG_UID}}" "/run/user/$${ARG_UID}"
      fi

      # Ensure .codex dir exists with correct ownership
      mkdir -p "/home/$${ARG_UNAME:-user}/.codex"
      chown "$${ARG_UID}:$${ARG_GID:-$${ARG_UID}}" "/home/$${ARG_UNAME:-user}/.codex"

      exec "$$@"