docker-compose.yml

###############################################################################
# omp-live-chrome — deployment file
#
# No need to clone the repo; just download this one file and the (optional)
# certificate helper.
#
# Quick start:
#   curl -fsSL -O https://raw.githubusercontent.com/ZhxChen/omp-live-chrome/main/docker-compose.yml
#   docker compose up -d
#   open https://192.168.1.10:30141  # omp-web + embedded Chrome
#
# On first start, omp auto-generates a self-signed cert into ./data/proxy
# for localhost by default. Reuse persists across restarts.
#
# After first start, authenticate an LLM provider in omp-web (Models/Auth).
# Credentials are persisted to ./data/omp and restored on restart.
#
# Data directories (auto-created):
#   ./data/chrome    — Chrome user data (cookies, bookmarks, extensions)
#   ./data/omp       — OMP agent dir: config.yml, auth db, sessions, skills
#   ./data/workspace — user projects / default working directory
#   ./data/proxy     — persistent TLS certificate for the public proxy
#
# Updating:
#   docker compose pull && docker compose up -d
#   Pinned versions live in the image — there are no in-container package
#   updates; to upgrade, bump the versions and rebuild/publish the image.
#
# Security: the proxy exposes agent and desktop control on all IPv4 interfaces
# by default. Use a VPN or authenticated reverse proxy and never expose it to
# untrusted networks.
###############################################################################

services:
  chrome:
    image: lscr.io/linuxserver/chrome:version-151.0.7922.108-1
    restart: unless-stopped
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Asia/Shanghai
      - LC_ALL=zh_CN.UTF-8
      # --user-data-dir=/config/omp-profile is required: Chrome >= 136 ignores
      # --remote-debugging-port when the default profile directory is used.
      - CHROME_CLI=--remote-debugging-port=9222 --remote-debugging-address=127.0.0.1 --remote-allow-origins=http://localhost --user-data-dir=/config/omp-profile --no-first-run
      - SELKIES_MANUAL_WIDTH=1920
      - SELKIES_MANUAL_HEIGHT=1080
      - SELKIES_IS_MANUAL_RESOLUTION_MODE=true
    ports:
      # omp shares this network namespace. Every published target is omp's
      # Nginx listener; Chrome's own CDP port has no direct host mapping.
      # Defaults to all IPv4 interfaces. To make it local-only, use:
      # - "127.0.0.1:30141:8443"
      - "30141:8443"
    shm_size: "2gb"
    volumes:
      - ./data/chrome:/config

  omp:
    image: ghcr.io/zhxchen/omp-live-chrome:latest
    # pull_policy: always
    restart: unless-stopped
    network_mode: "service:chrome"
    working_dir: /workspace
    environment:
      # Optional SAN override for the auto-generated self-signed certificate:
      # - PUBLIC_HOST=omp-bot.lan
      - HOME=/workspace
      - OMP_WEB_PORT=30141
      # OMP agent dir. omp-web reads OMP_CODING_AGENT_DIR (higher priority);
      # the omp CLI reads PI_CODING_AGENT_DIR. Both point at the same path.
      - OMP_CODING_AGENT_DIR=/state/omp/agent
      - PI_CODING_AGENT_DIR=/state/omp/agent
      - CDP_URL=http://127.0.0.1:9222
      # Keep caches out of the persisted agent dir.
      - XDG_CACHE_HOME=/tmp/cache
      - NPM_CONFIG_CACHE=/tmp/npm-cache
      - TZ=Asia/Shanghai
    volumes:
      # Persistent OMP state: config, auth, sessions, skills.
      - ./data/omp:/state/omp
      # Persistent user workspace / default working directory.
      - ./data/workspace:/workspace
      # Persistent TLS certificate for the public proxy.
      - ./data/proxy:/etc/nginx/certs
    depends_on:
      - chrome