bisheng/docker/docker-compose.yml

services:
  mysql:
    container_name: bisheng-mysql
    image: mysql:8.0
    
    ports:
      - "3306:3306"
    environment:
      MYSQL_ROOT_PASSWORD: "1234"  # 数据库密码，如果修改需要同步修改bisheng/congfig/config.yaml配置database_url的mysql连接密码
      MYSQL_DATABASE: bisheng
      TZ: Asia/Shanghai
    volumes:
      - ${DOCKER_VOLUME_DIRECTORY:-.}/mysql/conf/my.cnf:/etc/mysql/my.cnf
      - ${DOCKER_VOLUME_DIRECTORY:-.}/mysql/data:/var/lib/mysql
    healthcheck:
      test: ["CMD-SHELL", "exit | mysql -u root -p$$MYSQL_ROOT_PASSWORD"]
      start_period: 30s
      interval: 20s
      timeout: 10s
      retries: 4
    restart: on-failure

  openfga-migrate:
    container_name: bisheng-openfga-migrate
    image: openfga/openfga:latest
    command: migrate
    environment:
      OPENFGA_DATASTORE_ENGINE: mysql
      OPENFGA_DATASTORE_URI: "root:1234@tcp(mysql:3306)/openfga?parseTime=true"
    depends_on:
      mysql:
        condition: service_healthy

  openfga:
    container_name: bisheng-openfga
    image: openfga/openfga:latest
    command: run
    environment:
      OPENFGA_DATASTORE_ENGINE: mysql
      OPENFGA_DATASTORE_URI: "root:1234@tcp(mysql:3306)/openfga?parseTime=true"
      OPENFGA_LOG_FORMAT: json
      OPENFGA_PLAYGROUND_ENABLED: "true"
    ports:
      - "8080:8080"
      - "8081:8081"
      - "3000:3000"
    depends_on:
      openfga-migrate:
        condition: service_completed_successfully
    # 不在 compose 里写 HEALTHCHECK：openfga 官方镜像为 distroless，无 /bin/sh、无 wget，
    # CMD-SHELL 会永久 unhealthy。未定义时 Compose 将 ``service_healthy`` 视为已启动即可。
    restart: unless-stopped

  redis:
    container_name: bisheng-redis
    image: redis:7.0.4
    ports:
      - "6379:6379"
    environment:
      TZ: Asia/Shanghai
    volumes:
      - ${DOCKER_VOLUME_DIRECTORY:-.}/data/redis:/data
      - ${DOCKER_VOLUME_DIRECTORY:-.}/redis/redis.conf:/etc/redis.conf
    command: redis-server /etc/redis.conf
    healthcheck:
      test: ["CMD-SHELL", 'redis-cli ping|grep -e "PONG\|NOAUTH"']
      interval: 10s
      timeout: 5s
      retries: 3
    restart: on-failure

  backend:
    container_name: bisheng-backend
    image: dataelement/bisheng-backend:v2.5-local
    ports:
      - "7860:7860"
    environment:
      TZ: Asia/Shanghai
      BS_SSO_SYNC__GATEWAY_HMAC_SECRET: "bisheng-local-hmac-20260422"
      BS_MILVUS_CONNECTION_ARGS: '{"host":"milvus","port":"19530","user":"","password":"","secure":false}'
      BS_MILVUS_IS_PARTITION: 'true'
      BS_MILVUS_PARTITION_SUFFIX: '1'
      BS_ELASTICSEARCH_URL: 'http://elasticsearch:9200'
      BS_ELASTICSEARCH_SSL_VERIFY: '{}'  # 可根据自己部署的密码进行配置 '{"basic_auth": ("elastic", "elastic")}'
      BS_MINIO_SCHEMA: 'false'
      BS_MINIO_CERT_CHECK: 'false'
      BS_MINIO_ENDPOINT: 'minio:9000'
      BS_MINIO_SHAREPOINT: 'minio:9000'
      BS_MINIO_ACCESS_KEY: 'minioadmin'
      BS_MINIO_SECRET_KEY: 'minioadmin'
    volumes:
      - ${DOCKER_VOLUME_DIRECTORY:-.}/bisheng/config/config.yaml:/app/bisheng/config.yaml
      - ${DOCKER_VOLUME_DIRECTORY:-.}/bisheng/entrypoint.sh:/app/entrypoint.sh
      - ${DOCKER_VOLUME_DIRECTORY:-.}/data/bisheng:/app/data
      # 开发/热修：挂载本地 endpoints，使 GET /api/v1/all 等兼容路由无需重打镜像
      - ../src/backend/bisheng/api/v1/endpoints.py:/app/bisheng/api/v1/endpoints.py:ro
      # Bearer + 禁用账号校验在 http_middleware；镜像默认只读 Cookie，不挂则 Platform 永不被踢下线
      - ../src/backend/bisheng/utils/http_middleware.py:/app/bisheng/utils/http_middleware.py:ro
      - ../src/backend/bisheng/common/middleware/admin_scope.py:/app/bisheng/common/middleware/admin_scope.py:ro
    security_opt:
      - seccomp:unconfined
    command: sh entrypoint.sh api  # 启动api服务
    restart: on-failure
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:7860/health"]
      start_period: 30s
      interval: 90s
      timeout: 30s
      retries: 3
    depends_on:
      mysql:
        condition: service_healthy
      redis:
        condition: service_healthy
      # openfga 官方镜像无 HEALTHCHECK，Compose v5 无法用 service_healthy
      openfga:
        condition: service_started

  backend_worker:
    container_name: bisheng-backend-worker
    image: dataelement/bisheng-backend:v2.5-local
    environment:
      TZ: Asia/Shanghai
      BS_SSO_SYNC__GATEWAY_HMAC_SECRET: "bisheng-local-hmac-20260422"
      BS_MILVUS_CONNECTION_ARGS: '{"host":"milvus","port":"19530","user":"","password":"","secure":false}'
      BS_MILVUS_IS_PARTITION: 'true'
      BS_MILVUS_PARTITION_SUFFIX: '1'
      BS_ELASTICSEARCH_URL: 'http://elasticsearch:9200'
      BS_ELASTICSEARCH_SSL_VERIFY: '{}'  # 可根据自己部署的密码进行配置 '{"basic_auth": ("elastic", "elastic")}'
      BS_MINIO_SCHEMA: 'false'
      BS_MINIO_CERT_CHECK: 'false'
      BS_MINIO_ENDPOINT: 'minio:9000'
      BS_MINIO_SHAREPOINT: 'minio:9000'
      BS_MINIO_ACCESS_KEY: 'minioadmin'
      BS_MINIO_SECRET_KEY: 'minioadmin'
    volumes:
      - ${DOCKER_VOLUME_DIRECTORY:-.}/bisheng/config/config.yaml:/app/bisheng/config.yaml
      - ${DOCKER_VOLUME_DIRECTORY:-.}/bisheng/entrypoint.sh:/app/entrypoint.sh
      - ${DOCKER_VOLUME_DIRECTORY:-.}/data/bisheng:/app/data
    security_opt:
      - seccomp:unconfined
    command: sh entrypoint.sh worker  # 启动celery的异步worker服务，用来处理一些耗时的任务
    restart: on-failure
    depends_on:
      mysql:
        condition: service_healthy
      redis:
        condition: service_healthy
      openfga:
        condition: service_started

  frontend:
    container_name: bisheng-frontend
    # 注意：此处为 Hub 的 latest，未必与自建镜像 backend:v2.5-local 同版本；界面偏旧请 pull 最新或按源码 build（见 AGENTS / 部署文档）
    image: dataelement/bisheng-frontend:latest
    ports:
      - "3001:3001"
    environment:
      TZ: Asia/Shanghai
    volumes:
      - ${DOCKER_VOLUME_DIRECTORY:-.}/nginx/nginx.conf:/etc/nginx/nginx.conf
      - ${DOCKER_VOLUME_DIRECTORY:-.}/nginx/conf.d:/etc/nginx/conf.d
    restart: on-failure
    depends_on:
      - backend

  elasticsearch:
    container_name: bisheng-es
    image: docker.io/bitnamilegacy/elasticsearch:8.12.0
    user: root
    ports:
      - "9200:9200"
      - "9300:9300"
    environment:
      TZ: Asia/Shanghai
    volumes:
      - ${DOCKER_VOLUME_DIRECTORY:-.}/data/es:/bitnami/elasticsearch/data
    restart: on-failure

  etcd:
    container_name: bisheng-milvus-etcd
    image: quay.io/coreos/etcd:v3.5.5
    environment:
      ETCD_AUTO_COMPACTION_MODE: revision
      ETCD_AUTO_COMPACTION_RETENTION: "1000"
      ETCD_QUOTA_BACKEND_BYTES: "4294967296"
      ETCD_SNAPSHOT_COUNT: "50000"
      TZ: Asia/Shanghai
    volumes:
      - ${DOCKER_VOLUME_DIRECTORY:-.}/data/milvus-etcd:/etcd
    command: etcd -advertise-client-urls=http://127.0.0.1:2379 -listen-client-urls http://0.0.0.0:2379 --data-dir /etcd
    restart: on-failure
    healthcheck:
      test: ["CMD", "etcdctl", "endpoint", "health"]
      interval: 30s
      timeout: 20s
      retries: 3

  minio:
    container_name: bisheng-milvus-minio
    image: minio/minio:RELEASE.2023-03-20T20-16-18Z
    environment:
      MINIO_ACCESS_KEY: minioadmin
      MINIO_SECRET_KEY: minioadmin
    ports:
      - "9100:9000"
      - "9101:9001"
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${DOCKER_VOLUME_DIRECTORY:-.}/data/milvus-minio:/minio_data
    command: minio server /minio_data --console-address ":9001"
    restart: on-failure
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
      interval: 30s
      timeout: 20s
      retries: 3

  milvus:
    container_name: bisheng-milvus-standalone
    image: milvusdb/milvus:v2.5.10
    command: ["milvus", "run", "standalone"]
    security_opt:
    - seccomp:unconfined
    environment:
      ETCD_ENDPOINTS: etcd:2379
      MINIO_ADDRESS: minio:9000
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${DOCKER_VOLUME_DIRECTORY:-.}/data/milvus:/var/lib/milvus
    restart: on-failure
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:9091/healthz"]
      start_period: 90s
      interval: 30s
      timeout: 20s
      retries: 3
    ports:
      - "19530:19530"
      - "9091:9091"
    depends_on:
      - etcd
      - minio