docker-compose.yml

services:
  iris-eval:
    build: .
    # Two servers, two ports: 3000 = MCP HTTP transport, 6920 = dashboard
    # (which also serves POST /api/v1/traces, the no-MCP-client ingest path).
    # Publishing only 3000 leaves the dashboard running and unreachable.
    ports:
      - "3000:3000"
      - "6920:6920"
    volumes:
      - iris-data:/data
    environment:
      - IRIS_TRANSPORT=http
      - IRIS_PORT=3000
      # 0.0.0.0 inside the container: the process defaults to loopback, which
      # is unreachable through a published port. See the Dockerfile comment.
      - IRIS_HOST=0.0.0.0
      # Required. Both servers bind 0.0.0.0 inside the container, and the
      # process refuses a non-loopback bind with no key at boot (0.13.0);
      # compose refuses here first, before the container starts, so the
      # failure is one sentence and not a restart loop. Generate one with
      # `openssl rand -hex 32` and export it (or put it in a .env file).
      - IRIS_API_KEY=${IRIS_API_KEY:?set IRIS_API_KEY before docker compose up (openssl rand -hex 32)}
      # The Iris home is the volume: deployed rules, audit.log and
      # config.json persist with the database.
      - IRIS_HOME=/data
      - IRIS_DB_PATH=/data/iris.db
      - IRIS_DASHBOARD=true
      - IRIS_DASHBOARD_PORT=6920
      - IRIS_DASHBOARD_HOST=0.0.0.0
      - IRIS_LOG_LEVEL=info
    restart: unless-stopped

volumes:
  iris-data: