compose.yaml

name: ce-vm

# 默认路径：Docker 只运行 QEMU/KVM，CE 在 VM 内由 systemd + nsjail 运行。

services:
  qemu:
    build: ./vm
    image: ssct/ce-qemu:local
    container_name: ce-vm
    restart: always

    devices:
      - /dev/kvm:/dev/kvm

    environment:
      VM_CPUS: "${VM_CPUS:-8}"
      VM_MEM_MB: "${VM_MEM_MB:-8192}"
      VM_DISK_SIZE: "${VM_DISK_SIZE:-40G}"
      VM_IMAGE_URL: "${VM_IMAGE_URL:-}"
      VM_IMAGE_SHA256: "${VM_IMAGE_SHA256:-}"
      VM_IMAGE_SHA256_URL: "${VM_IMAGE_SHA256_URL:-}"
      FORCE_REPROVISION: "${FORCE_REPROVISION:-0}"
      CE_REF: "${CE_REF:-gh-18904}"
      NODE_VERSION: "${NODE_VERSION:-}"
      NODE_SHA256: "${NODE_SHA256:-}"
      SSH_FWD_PORT: "${CE_VM_SSH_PORT:-2223}"

    volumes:
      - vm-disk:/vm/disk
      - "${CE_COMPILERS_ROOT:?请在 .env 设置 CE_COMPILERS_ROOT}:/share/compilers:ro"
      # 默认使用独立 named volume；设置 CE_STORAGE_ROOT 可改为宿主机绝对路径。
      - "${CE_STORAGE_ROOT:-ce-storage}:/share/storage"
      # guest 装配只需这三个目录，避免把 .env 与 .git 暴露给 VM。
      - ./config:/share/repo/config:ro
      - ./scripts:/share/repo/scripts:ro
      - ./vm:/share/repo/vm:ro
      - "${CE_VM_SSH_PUBKEY:-/dev/null}:/share/sshpub/ce_vm_key.pub:ro"

    ports:
      - "10240:10240"
      - "127.0.0.1:${CE_VM_SSH_PORT:-2223}:${CE_VM_SSH_PORT:-2223}"

    stop_grace_period: 40s

    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:10240/healthcheck"]
      interval: 30s
      timeout: 5s
      start_period: 15m
      retries: 3

    cap_drop: ["ALL"]
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp:rw,nosuid,nodev,size=256m,uid=0,gid=0,mode=1777

    mem_limit: "${QEMU_MEM_LIMIT:-10g}"
    cpus: "${QEMU_CPUS:-10}"
    pids_limit: 512

volumes:
  vm-disk:
  ce-storage:
    name: "${CE_STORAGE_VOLUME_NAME:-ce-shortlinks}"