# Docker

JCode includes a Docker image definition for the daemon and bundled browser UI. The project does not publish a public registry image, so build it from your checkout:

```bash
docker build -f docker/base/Dockerfile -t jcode:local .
docker run -d --name jcode \
  -p 6767:6767 \
  -e JCODE_PASSWORD=change-me \
  -v "$PWD/jcode-home:/home/jcode" \
  -v "$PWD:/workspace" \
  jcode:local
```

Then open `http://localhost:6767`.

The image runs the daemon and CLI, serves the web UI, stores state under `/home/jcode/.jcode`, and runs normal work as the non-root `jcode` user. It does not bundle provider CLIs.

## Docker Compose

The repository includes `docker/docker-compose.example.yml`. Run it from the repository root:

```bash
docker compose -f docker/docker-compose.example.yml build
docker compose -f docker/docker-compose.example.yml up -d
```

## Install agent CLIs

After building `jcode:local`, build the example child image:

```bash
docker build -f docker/Dockerfile.agents.example -t jcode-with-agents .
```

Use `image: jcode-with-agents` in Compose. Authenticate providers with environment variables, mounted config, or their login command inside the container.

## Volumes

| Mount         | Purpose                                                |
| ------------- | ------------------------------------------------------ |
| `/home/jcode` | JCode state plus provider config and credentials       |
| `/workspace`  | Code that JCode and launched agents can read and write |

The built-in user is uid/gid `1000:1000`; make bind mounts writable by that user.

## Reverse proxy

Forward HTTP and WebSocket traffic to port `6767`. Set `JCODE_HOSTNAMES` when using a DNS name.

```caddy
jcode.example.com {
  reverse_proxy 127.0.0.1:6767
}
```

## Security

- Set `JCODE_PASSWORD` for every network-reachable deployment.
- Terminate HTTPS at the reverse proxy.
- Treat mounted workspaces and provider credentials as accessible to launched agents.
- Use the relay if you do not want to expose the daemon port directly.

GitLab CI verifies an x64 Linux Docker build. It does not publish an image.