Single-VM Docker Compose

​

Overview

​

Architecture

Browser ──HTTPS──► Caddy ──► WebUI (3000)
                     │
                     └─────► Control Plane (8003)
                                   │
                    ┌──────────────┼──────────────┐
                    ▼              ▼              ▼
              PostgreSQL        Redis       Host Docker
                                                │
                                   ┌────────────┴────────────┐
                                   ▼                         ▼
                            per-user sandbox          persistent volume

• Caddy terminates TLS and routes /api, /proxy, /ws, /llm-relay, /tool-relay, /tunnel-relay, /vnc to the control plane; everything else goes to the WebUI.
• The control plane uses the host Docker socket to create sandboxes and proxies WebSocket/HTTP traffic to them.
• PostgreSQL stores control-plane data; each sandbox keeps its workspace and memory in a Docker volume.

​

Prerequisites

• Ubuntu 22.04/24.04, 8 vCPU / 16 GB RAM
• Docker 24+ with Compose v2
• A DNS record for your domain; ports 80/443 reachable
• OIDC identity provider (Okta, Entra ID, Keycloak, etc.)
• Signed enterprise license JWT and the vendor public key
• Optional: runsc (gVisor) on the host for stronger sandbox isolation

​

Quick start

cd myrm-control-plane
cp deploy/compose/.env.example deploy/compose/.env

# Edit .env:
#   MYRM_DOMAIN, POSTGRES_PASSWORD, DOCKER_GID
#   MYRM_CP_ENTERPRISE_LICENSE_KEY / _PUBLIC_KEY
#   MYRM_CP_JWT_SECRET, MYRM_CP_MASTER_ENCRYPTION_KEY
#   MYRM_CP_OIDC_* and MYRM_CP_ADMIN_USER_IDS

docker compose -f deploy/compose/docker-compose.yml up -d
docker compose -f deploy/compose/docker-compose.yml ps

stat -c '%g' /var/run/docker.sock

​

Configuration

https://<MYRM_DOMAIN>/api/auth/oauth/oidc/callback

​

First administrator and organization

1. Sign in once through OIDC.
2. Create the organization owned by that user:
   docker compose -f deploy/compose/docker-compose.yml exec control-plane \
     python -m myrm_control_plane.bootstrap --org "Company" --admin-email admin@company.com
   
3. Put the printed owner_user_id into MYRM_CP_ADMIN_USER_IDS in .env and restart the control plane:
   docker compose -f deploy/compose/docker-compose.yml up -d control-plane
   

​

Using an existing reverse proxy

​

Operations

# Logs
docker compose -f deploy/compose/docker-compose.yml logs -f control-plane

# Restart
docker compose -f deploy/compose/docker-compose.yml restart

# Upgrade (pin MYRM_VERSION in .env first)
docker compose -f deploy/compose/docker-compose.yml pull
docker compose -f deploy/compose/docker-compose.yml up -d

BACKUP_DIR=/srv/myrm-backups RETENTION_DAYS=30 ./deploy/compose/backup.sh

​

Scope and limits

• Single VM only. No HA, clustering or multi-region failover.
• Small teams; benchmark with your workload before rollout and size up or split by team as needed.
• OIDC only. SAML and SCIM are not part of this deployment.
• No BYOK/KMS or air-gapped mode.
• Linux only (the sandbox runtime uses the host Docker daemon).
• Supported OS: Ubuntu 22.04/24.04 with Docker from the official repository.

​

Security notes

• Mounting the Docker socket gives the control plane host-level container control. Restrict SSH and Docker access to trusted administrators.
• Sandboxes drop privileges and unnecessary capabilities, and enforce CPU/memory/PID limits. Docker security options add seccomp/AppArmor. Install runsc and use docker_gvisor when stronger isolation is required.
• Each employee has a separate sandbox and volume. Administrators can review audit events and usage; configure retention and access according to company policy.
• Keep .env out of version control and rotate the JWT/master keys only with a planned migration.