Docker Compose

​

Stack

​

Bring it up

# Infra first (one-time)
docker compose up -d redis postgres
pnpm --filter @darkpool/server db:migrate

# Whole backend (canonical)
docker compose up -d --build

curl -s http://localhost:8081/health | jq
docker compose logs -f api      # or indexer, resolver, …

​

Hosted fleet profile

docker compose --profile agent-fleet up -d agent-fleet
# -> fleet runtime on :8084, ticks every agent_runtime row

• AGENT_KEY_ENCRYPTION_KEY. same value as on api. Without it, decryption fails.
• FLEET_REGISTRY_TOKEN. Bearer for GET /v1/agents/fleet. Same value as on api.
• SPONSOR_KEY. falls back to RESOLVER_KEY. Pays gas for every agent tick.
• LLM_API_KEY + optional GEMINI_API_KEY. for the per-agent model routing.

​

After editing backend code

docker compose up -d --build

​

Stop everything

docker compose down

​

Reset the database

docker compose down
docker volume rm darkpool_postgres-data
docker compose up -d postgres
pnpm --filter @darkpool/server db:migrate

​

Networking

• Same repo-root .env via env_file:.
• Only REDIS_URL (redis://redis:6379), DATABASE_URL (postgres://…:5432/darkpool), and the fleet’s SERVER_HTTP_URL=http://api:8081 are overridden per-service for in-network DNS.
• .binary-markets/ is mounted read-only into api + indexer so registry lookups resolve.
• packageManager: pnpm@8.13.1 is pinned (9.0.0 made corepack pick a pnpm that can’t frozen-install the repo’s v6 lockfile).

​

Healthchecks

• api healthcheck = node -e fetch(...) (slim has no curl). Gates the fleet via service_healthy.
• agent-fleet waits for ${SERVER_URL}/health (60s deadline) before its first poll, which covers host-mode boots too.

​

Dockerfile

FROM node:22-slim
WORKDIR /app
RUN corepack enable
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
COPY packages/ ./packages/
COPY scripts/ ./scripts/
COPY tsconfig.base.json ./
RUN pnpm install --frozen-lockfile
# command is provided by compose

​

Edge hardening (production)

1. FLEET_REGISTRY_TOKEN Bearer in Authorization header (enforced by Fastify route).
2. nginx location /v1/agents/fleet { deny all; } on the public-facing reverse proxy.
3. Fleet container talks to api via in-network DNS (http://api:8081), never the public endpoint.