dstack-examples/k3s/docker-compose.yaml at main · Dstack-TEE/dstack-examples · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
services:
  kmod-installer:
    image: kvin/dstack-extra-kmods:0.5.8
    privileged: true
    pid: host
    volumes:
      - /:/host
    restart: "no"

  k3s:
    image: rancher/k3s:v1.31.6-k3s1
    command:
      - server
      - --node-name=${K3S_NODE_NAME:-k3s-node}
      - --tls-san=0.0.0.0
      - --tls-san=${DSTACK_APP_ID}-6443s.${DSTACK_GATEWAY_DOMAIN}
      - --kubelet-arg=max-pods=512
    privileged: true
    ports:
      - "6443:6443"     # Kubernetes API (TLS passthrough via gateway)
      - "80:80"          # Traefik HTTP entrypoint
      - "8443:443"       # Traefik HTTPS entrypoint (internal)
    environment:
      - K3S_KUBECONFIG_MODE=644
    tmpfs:
      - /run
      - /var/run
    volumes:
      - k3s-data:/var/lib/rancher/k3s
      - k3s-kubelet:/var/lib/kubelet
      - k3s-etc:/etc/rancher
      - k3s-log:/var/log
    depends_on:
      kmod-installer:
        condition: service_completed_successfully
    restart: unless-stopped

  dstack-ingress:
    image: dstacktee/dstack-ingress:2.2@sha256:d05a7b343c37c1cca1bba8dbf7e8f3c6d2118158af2d41c455103796db4f67f0
    ports:
      - "443:443"
    environment:
      - DNS_PROVIDER=cloudflare
      - CLOUDFLARE_API_TOKEN=${CLOUDFLARE_API_TOKEN}
      - DOMAIN=*.${CLUSTER_DOMAIN}
      - GATEWAY_DOMAIN=_.${DSTACK_GATEWAY_DOMAIN}
      - CERTBOT_EMAIL=${CERTBOT_EMAIL}
      - SET_CAA=true
      - TARGET_ENDPOINT=k3s:80
      - EVIDENCE_PORT=8080
    volumes:
      - /var/run/dstack.sock:/var/run/dstack.sock
      - /var/run/tappd.sock:/var/run/tappd.sock
      - cert-data:/etc/letsencrypt
    depends_on:
      - k3s
    restart: unless-stopped

volumes:
  k3s-data:
  k3s-kubelet:
  k3s-etc:
  k3s-log:
  cert-data: