docker-compose.yml

# Auto-generated by ./scripts/setup.sh from config/arena.env.
# Re-run that script instead of editing this file.

name: sandcastle

x-sandcastle-arena:
  team_count: 2
  service_port: 8080
  ssh_base_port: 2200
  ssh_bind_host: 127.0.0.1
  startup_timeout_seconds: 120
  round_duration_seconds: 120
  flag_expiry_rounds: 5
  checker_max_concurrency: 8
  gameserver_port: 8000
  visualizer_port: 4173
  submission_rate_limit: 60
  submission_rate_window_seconds: 60
  score_attack_points: 10
  score_defense_points: 2
  score_sla_points: 1
  team_vuln_mem_limit: 512m
  team_vuln_cpu_limit: 0.50
  team_vuln_pids_limit: 200
  team_ssh_mem_limit: 128m
  team_ssh_cpu_limit: 0.25
  team_ssh_pids_limit: 100
  team_app_mem_limit: 256m
  team_app_cpu_limit: 0.50
  team_app_pids_limit: 100
  team_max_restarts: 5
  visualizer_mem_limit: 128m
  visualizer_cpu_limit: 0.25
  log_max_size: 50m
  log_max_files: 3
  agent_provider: fake
  agent_model: gpt-5.4-mini
  agent_max_calls_per_round: 2
  agent_max_calls_per_match: 30
  agent_max_cost_usd_per_match: 5.00

networks:
  ctf-network:
    driver: bridge
    ipam:
      config:
        - subnet: 10.10.0.0/16
          gateway: 10.10.0.1
  control-plane:
    driver: bridge

services:
  team1-vuln:
    build:
      context: .
      dockerfile: docker/vuln/Dockerfile
      args:
        TEAM_ID: "1"
        TEAM_NAME: "team1"
        TEAM_USER: "team1"
        TEAM_PASS: "team1pass"
        TEAM_UID: "1000"
    image: sandcastle/team1-vuln:latest
    container_name: team1-vuln
    hostname: team1-vuln
    networks:
      ctf-network:
        ipv4_address: 10.10.1.3
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./config/arena.env:/tmp/arena.env:ro
      - ./teams/generated/team1/example-vuln:/home/team1/example-vuln
      - ./services/example-vuln:/srv/example-vuln:ro
    cap_add:
      - NET_ADMIN
    labels:
      sandcastle.role: "vuln-machine"
      sandcastle.team: "team1"
    deploy:
      resources:
        limits:
          memory: 512m
          cpus: '0.50'
          pids: 200
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "3"
    restart: "on-failure:5"

  team1-ssh:
    build:
      context: .
      dockerfile: docker/ssh/Dockerfile
      args:
        TEAM_ID: "1"
        TEAM_NAME: "team1"
        TEAM_USER: "team1"
        TEAM_PASS: "team1pass"
        TEAM_UID: "1000"
    image: sandcastle/team1-ssh:latest
    container_name: team1-ssh
    hostname: team1-ssh
    depends_on:
      - team1-vuln
    networks:
      ctf-network:
        ipv4_address: 10.10.1.2
    ports:
      - "127.0.0.1:2201:22"
    cap_add:
      - NET_ADMIN
    labels:
      sandcastle.role: "ssh-gateway"
      sandcastle.team: "team1"
    deploy:
      resources:
        limits:
          memory: 128m
          cpus: '0.25'
          pids: 100
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "3"
    restart: "on-failure:5"

  team2-vuln:
    build:
      context: .
      dockerfile: docker/vuln/Dockerfile
      args:
        TEAM_ID: "2"
        TEAM_NAME: "team2"
        TEAM_USER: "team2"
        TEAM_PASS: "team2pass"
        TEAM_UID: "1000"
    image: sandcastle/team2-vuln:latest
    container_name: team2-vuln
    hostname: team2-vuln
    networks:
      ctf-network:
        ipv4_address: 10.10.2.3
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./config/arena.env:/tmp/arena.env:ro
      - ./teams/generated/team2/example-vuln:/home/team2/example-vuln
      - ./services/example-vuln:/srv/example-vuln:ro
    cap_add:
      - NET_ADMIN
    labels:
      sandcastle.role: "vuln-machine"
      sandcastle.team: "team2"
    deploy:
      resources:
        limits:
          memory: 512m
          cpus: '0.50'
          pids: 200
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "3"
    restart: "on-failure:5"

  team2-ssh:
    build:
      context: .
      dockerfile: docker/ssh/Dockerfile
      args:
        TEAM_ID: "2"
        TEAM_NAME: "team2"
        TEAM_USER: "team2"
        TEAM_PASS: "team2pass"
        TEAM_UID: "1000"
    image: sandcastle/team2-ssh:latest
    container_name: team2-ssh
    hostname: team2-ssh
    depends_on:
      - team2-vuln
    networks:
      ctf-network:
        ipv4_address: 10.10.2.2
    ports:
      - "127.0.0.1:2202:22"
    cap_add:
      - NET_ADMIN
    labels:
      sandcastle.role: "ssh-gateway"
      sandcastle.team: "team2"
    deploy:
      resources:
        limits:
          memory: 128m
          cpus: '0.25'
          pids: 100
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "3"
    restart: "on-failure:5"

  firewall:
    build:
      context: ./firewall
    image: sandcastle/firewall:latest
    container_name: sandcastle-firewall
    hostname: sandcastle-firewall
    network_mode: host
    environment:
      CTF_NETWORK: "10.10.0.0/16"
      CTF_GATEWAY: "10.10.0.1"
      WS_PORT: "6789"
      PROXY_PORT: "15000"
      EVENT_QUEUE_SIZE: "2048"
      CAPTURE_RCVBUF_BYTES: "4194304"
      RECENT_ICMP_LIMIT: "4096"
    cap_add:
      - NET_ADMIN
      - NET_RAW
    labels:
      sandcastle.role: "firewall"
    deploy:
      resources:
        limits:
          memory: 128m
          cpus: '0.50'
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "3"
    restart: unless-stopped

  gameserver:
    build:
      context: .
      dockerfile: gameserver/Dockerfile
    image: sandcastle/gameserver:latest
    container_name: sandcastle-gameserver
    hostname: sandcastle-gameserver
    networks:
      ctf-network:
        ipv4_address: 10.10.0.2
      control-plane: {}
    ports:
      - "8000:8000"
    volumes:
      - gameserver-data:/app/data
      - ./config/arena.env:/app/config/arena.env:ro
    environment:
      CHECKER_MASTER_SECRET: "sandcastle-local-checker-secret-change-me"
      GAMESERVER_OPERATOR_TOKEN: "sandcastle-local-operator-token-change-me"
    labels:
      sandcastle.role: "gameserver"
    deploy:
      resources:
        limits:
          memory: 512m
          cpus: '1.00'
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "3"
    restart: unless-stopped

  bot-controller:
    build:
      context: .
      dockerfile: bot/Dockerfile
    image: sandcastle/bot-controller:latest
    container_name: sandcastle-bot-controller
    hostname: sandcastle-bot-controller
    networks:
      ctf-network:
        ipv4_address: 10.10.0.4
      control-plane: {}
    ports:
      - "127.0.0.1:7878:7878"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./config/arena.env:/app/config/arena.env:ro
      - ./challenges:/app/challenges
      - bot-controller-data:/data
    environment:
      ARENA_BOT_API_PORT: "7878"
      CHALLENGE_VALIDATION_NETWORK: "sandcastle_ctf-network"
      OPENAI_API_KEY: "${OPENAI_API_KEY:-}"
      GEMINI_API_KEY: "${GEMINI_API_KEY:-}"
    labels:
      sandcastle.role: "bot-controller"
      sandcastle.visualizer.hidden: "true"
    deploy:
      resources:
        limits:
          memory: 256m
          cpus: '0.50'
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "3"
    restart: unless-stopped

  visualizer:
    build:
      context: .
      dockerfile: visualizer/Dockerfile
    image: sandcastle/visualizer:latest
    container_name: sandcastle-visualizer
    hostname: sandcastle-visualizer
    network_mode: host
    labels:
      sandcastle.role: "visualizer"
    deploy:
      resources:
        limits:
          memory: 128m
          cpus: '0.25'
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "3"
    restart: unless-stopped

volumes:
  gameserver-data:
    name: sandcastle_gameserver-data
    labels:
      sandcastle.role: "gameserver-data"
  bot-controller-data:
    name: sandcastle_bot-controller-data
    labels:
      sandcastle.role: "bot-controller-data"