# Unified Docker Compose Configuration
#
# This file replaces docker-compose.rocm70_9-1.yaml and docker-compose.rocm70_9-1-shampoo.yaml
#
# Usage:
#   1. Copy .env.example to .env
#   2. Edit .env to set your Dockerfile, container name, and volume paths
#   3. Run: docker compose -f docker-compose.build.yaml up
#
# Or use the setup script:
#   bash setup-env.sh
#   docker compose -f docker-compose.build.yaml up

services:
  torchenv:
    container_name: ${CONTAINER_NAME:-training-overlap-bugs-default}
    image: ${IMAGE_NAME:-aorta:latest}
    build:
      context: .
      dockerfile: ${DOCKERFILE:-Dockerfile.rocm70_9-1}
      # Required for build: apt/npm access during docker compose build
      network: host
    # Security Configuration (Elevated Privileges Required)
    #
    # WARNING: This container runs with elevated privileges for AMD GPU access and debugging.
    # These settings have significant security implications, especially in shared/multi-user
    # environments. Only use this configuration in trusted environments.
    #
    # - user: root
    #   Required for: Installing packages, modifying system configuration, and ensuring
    #   consistent file permissions when mounting host volumes with different user IDs.
    #
    # - privileged: true
    #   Required for: Full access to AMD GPU devices (/dev/kfd, /dev/dri) and ROCm runtime.
    #   This grants the container nearly all capabilities of the host, including access to
    #   all devices and the ability to modify kernel parameters.
    #
    # - security_opt: seccomp=unconfined
    #   Required for: Debugging with ptrace (SYS_PTRACE capability) and ensuring ROCm
    #   kernel drivers can make all necessary system calls without seccomp restrictions.
    #   This disables the default seccomp profile that filters system calls.
    #
    # Security Implications:
    # - Container processes can access all host devices and perform privileged operations
    # - Potential for container escape if vulnerabilities exist in ROCm drivers or kernel
    # - File system modifications in mounted volumes will be owned by root
    # - In production or shared environments, consider using rootless containers with
    #   device cgroups or kata containers for better isolation
    #
    user: root
    privileged: true
    network_mode: host
    group_add:
      - video
    ipc: host
    cap_add:
      - SYS_PTRACE
    security_opt:
      - seccomp=unconfined
    environment:
      # RCCL: use image default. For custom RCCL, use override: -f docker-compose.rccl.yaml and set RCCL_PATH
      - RCCL_FOLDER=/rccl
      - TORCH_NCCL_HIGH_PRIORITY=1
      # Set driver variant for environment_info.json (since host /usr/src isn't visible)
      # Example values: "patched", "base", "mqd_vram", "default"
      - AMDGPU_DRIVER_VARIANT=${AMDGPU_DRIVER_VARIANT:-}

    volumes:
      # Mount parent directory (aorta/) to /workspace/aorta
      # Use AORTA_WORKSPACE env var if set, otherwise default to parent dir (..)
      - ${AORTA_WORKSPACE:-..}:/workspace/aorta
      # Custom RCCL: optional. To use a host RCCL build, run with override:
      #   docker compose -f docker-compose.build.yaml -f docker-compose.rccl.yaml up
      #   and set RCCL_PATH in .env to your RCCL directory. Do not add a volume here.
      # Optional: additional mounts. If you set EXTRA_MOUNT_SRC_* / EXTRA_MOUNT_DST_*
      # in .env, uncomment the line(s) below (both SRC and DST required per mount).
      # No extra mount when commented = no side effects.
      # - ${EXTRA_MOUNT_SRC_1}:${EXTRA_MOUNT_DST_1}
      # - ${EXTRA_MOUNT_SRC_2}:${EXTRA_MOUNT_DST_2}
    devices:
      - /dev/kfd
      - /dev/dri
    working_dir: /workspace/aorta
    shm_size: 17G
    ulimits:
      memlock: -1
      stack: 67108864
    stdin_open: true
    tty: true