docker-compose.yml

version: '3.8'

services:
  coder-db:
    image: postgres:16-alpine
    container_name: coder-db
    environment:
      POSTGRES_USER: coder
      POSTGRES_PASSWORD: coder_password_change_me
      POSTGRES_DB: coder
    volumes:
      - coder_db_data:/var/lib/postgresql/data
    restart: unless-stopped

  coder:
    image: ghcr.io/coder/coder:v2.33.6
    container_name: coder
    user: "0"  # run as root so the provisioner can access the Docker socket
    ports:
      - "7080:7080"
    environment:
      CODER_HTTP_ADDRESS: "0.0.0.0:7080"
      CODER_PG_CONNECTION_URL: "postgres://coder:coder_password_change_me@coder-db:5432/coder?sslmode=disable"
      CODER_ACCESS_URL: "http://localhost:7080"
      # GitHub OAuth2 — enables "Sign in with GitHub" on the login page
      CODER_OAUTH2_GITHUB_CLIENT_ID: "${GITHUB_CLIENT_ID}"
      CODER_OAUTH2_GITHUB_CLIENT_SECRET: "${GITHUB_CLIENT_SECRET}"
      CODER_OAUTH2_GITHUB_ALLOW_SIGNUPS: "true"
      CODER_OAUTH2_GITHUB_ALLOW_EVERYONE: "true"
      # GitHub external auth — used by workspace templates via coder_external_auth
      CODER_EXTERNAL_AUTH_0_ID: "github"
      CODER_EXTERNAL_AUTH_0_TYPE: "github"
      CODER_EXTERNAL_AUTH_0_CLIENT_ID: "${GITHUB_EXTERNAL_AUTH_CLIENT_ID}"
      CODER_EXTERNAL_AUTH_0_CLIENT_SECRET: "${GITHUB_EXTERNAL_AUTH_CLIENT_SECRET}"
      CODER_EXTERNAL_AUTH_0_SCOPES: "repo read:user user:email"
    volumes:
      # CRITICAL: This gives the Coder container permission to talk to the host's Docker
      - /var/run/docker.sock:/var/run/docker.sock
    depends_on:
      - coder-db
    restart: unless-stopped


volumes:
  coder_db_data: