devcon/example/devcon.yaml at main · 0rzech/devcon · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
# Replace 'project' with your project name and 'user:pat' with your user name and personal access token (PAT).
# Run this file with `podman-compose -f <path>/devcon.yaml up -d`.
#
# Currently, Dart and Flutter network calls fail when using krun Transparent Socket Impersonation (TSI).
# This *may* be fixed with https://github.com/libkrun/libkrun/releases/tag/v1.19.7 release.
#
# There is no such problem with passt/pasta, which currently won't work either until an update is released
# with https://github.com/containers/crun/pull/2334 fix for https://github.com/containers/crun/issues/2283.
# The workaround is to place the following wrapper script in "${HOME}/.local/bin" directory:
#
# ```bash
# #!/usr/bin/env bash
#
# set -euo pipefail
#
# if [[ -d '/proc' ]]; then
#   exec unshare --mount-proc '/usr/bin/passt' "${@}"
# else
#   exec '/usr/bin/passt' "${@}"
# fi
# ```
services:
  project:
    image: localhost/devcon:latest
    runtime: krun # usable on Linux; starts DEVCON container in a krun microvm
    annotations:
      krun.cpus: 2
      krun.ram_mib: 8192
      krun.use_passt: 1 # needed for Dart and Flutter network calls to work inside the microvm
    network_mode: pasta # needed for passt to work with krun
    security_opt:
      - no-new-privileges=true
    init: true # handles signals nicely and reaps processes properly
    secrets:
      - source: some-git-user-name-secret
        target: git-user-name # mandatory name
      - source: some-git-user-email-secret
        target: git-user-email # mandatory name
      - source: project-credentials
        target: /home/devcon/.config/git/credentials
      - source: mistral-api-key
        target: /home/devcon/.config/vibe/.env
    environment:
      DEVCON_GIT_REPO: 'https://github.com/user/project.git'
      DEVCON_WORK_DIR: 'project'
    env_file:
      - ./devcon.env
    volumes: # optional
      - home:/home/devcon
    ports:
      - '127.0.0.1:8000:8000'
    command: >
      code-server
      --bind-addr 0.0.0.0:8000
      --app-name project

volumes:
  home:

secrets:
  some-git-user-name-secret:
    external: true
  some-git-user-email-secret:
    external: true
  project-credentials: # example secret value: https://user:pat@github.com
    external: true
  mistral-api-key:
    external: true