# Opt-in override for a trusted Source Agent that should act as a host Docker controller.
# WARNING: /var/run/docker.sock is effectively host-root. Do not expose this Agent to untrusted users.
# Usage:
#   export DOCKER_GID=$(stat -c %g /var/run/docker.sock)
#   export BRAIN_CONTROLLER_COMPOSE_ROOT=/srv/brain-controller
#   docker compose -f deployment/docker-compose.source-agent.yml -f deployment/docker-compose.controller-agent.yml up -d --build
services:
  source-agent:
    environment:
      BRAIN_AGENT_DOCKER_CONTROLLER_ENABLED: "true"
      BRAIN_AGENT_DOCKER_SOCKET: /var/run/docker.sock
      BRAIN_AGENT_DOCKER_COMPOSE_BINARY: docker
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      # Mount the host Compose root at the SAME absolute path. Relative bind paths
      # in Compose files are then resolved consistently for the host daemon.
      - ${BRAIN_CONTROLLER_COMPOSE_ROOT:?set absolute host Compose root}:${BRAIN_CONTROLLER_COMPOSE_ROOT}:ro
    group_add:
      - "${DOCKER_GID:?set Docker socket group id}"