RC-3

deployment/docker-compose.controller-agent.yml

@@ -0,0 +1,19 @@
+# Opt-in override for a trusted Source Agent that should act as a host Docker controller.
+# WARNING: /var/run/docker.sock is effectively host-root. Do not expose this Agent to untrusted users.
+# Usage:
+#   export DOCKER_GID=$(stat -c %g /var/run/docker.sock)
+#   export BRAIN_CONTROLLER_COMPOSE_ROOT=/srv/brain-controller
+#   docker compose -f deployment/docker-compose.source-agent.yml -f deployment/docker-compose.controller-agent.yml up -d --build
+services:
+  source-agent:
+    environment:
+      BRAIN_AGENT_DOCKER_CONTROLLER_ENABLED: "true"
+      BRAIN_AGENT_DOCKER_SOCKET: /var/run/docker.sock
+      BRAIN_AGENT_DOCKER_COMPOSE_BINARY: docker
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      # Mount the host Compose root at the SAME absolute path. Relative bind paths
+      # in Compose files are then resolved consistently for the host daemon.
+      - ${BRAIN_CONTROLLER_COMPOSE_ROOT:?set absolute host Compose root}:${BRAIN_CONTROLLER_COMPOSE_ROOT}:ro
+    group_add:
+      - "${DOCKER_GID:?set Docker socket group id}"