services:
  workstation:
    image: "ghcr.io/okxlin/codex-claude-workstation:latest"
    container_name: ${CONTAINER_NAME}
    hostname: workstation
    restart: always
    labels:
      createdBy: "Apps"
    # Required by Codex/bubblewrap sandbox; keeps the container non-privileged.
    security_opt:
      - seccomp=unconfined
      - apparmor=unconfined
    environment:
      - TZ=${TZ:-Asia/Shanghai}
      - PASSWORD=${CODE_SERVER_PASSWORD:-change-me}
      - ROOT_PASSWORD=${ROOT_PASSWORD:-codex2024}
      - FIX_WORKSPACE_OWNERSHIP_RECURSIVE=${FIX_WORKSPACE_OWNERSHIP_RECURSIVE:-false}
      - GITHUB_TOKEN=${GITHUB_TOKEN}
      - GIT_AUTHOR_NAME=${GIT_AUTHOR_NAME}
      - GIT_AUTHOR_EMAIL=${GIT_AUTHOR_EMAIL}
      - GIT_COMMITTER_NAME=${GIT_COMMITTER_NAME}
      - GIT_COMMITTER_EMAIL=${GIT_COMMITTER_EMAIL}
    env_file:
      - path: ${CUSTOM_ENV_FILE:-./data/custom.env}
        required: false
    volumes:
      - ${APP_DATA_DIR:-./data}/workspace:/workspace
      - codex-home:/home/dev
      - ${DOCKER_SOCK_SRC:-/dev/null}:/var/run/docker.sock
    ports:
      - ${PANEL_APP_PORT_HTTP}:8080
    healthcheck:
      test: ["CMD", "/usr/local/bin/healthcheck.sh"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 15s
    networks:
      - 1panel-network

volumes:
  codex-home:
    name: codex-home

networks:
  1panel-network:
    external: true