| # Docker Compose configuration for host filesystem mount | |
| # OpenClaw Integration: AUTONOMOUS agents can access host directories | |
| # | |
| # SECURITY WARNING: This gives container write access to host filesystem. | |
| # Only use with AUTONOMOUS maturity gate + command whitelist + audit trail. | |
| # | |
| # Usage: | |
| # docker-compose -f docker-compose.yml -f docker-compose.host-mount.yml up | |
| version: '3.8' | |
| services: | |
| atom-api: | |
| volumes: | |
| # Host project directories (read-write) | |
| - /Users/${USER}/projects:/host/projects:rw | |
| - /Users/${USER}/Desktop:/host/desktop:rw | |
| - /Users/${USER}/Documents:/host/documents:rw | |
| - /tmp:/host/tmp:rw | |
| environment: | |
| # Configure allowed mount directories | |
| - ATOM_HOST_MOUNT_DIRS=/tmp:/Users/${USER}/projects:/Users/${USER}/Desktop:/Users/${USER}/Documents | |
| - ATOM_HOST_MOUNT_ENABLED=true | |
| # Capabilities for filesystem access | |
| cap_add: | |
| - SYS_ADMIN # Required for some filesystem operations | |
| # Security notes | |
| # - volumes: Explicitly list only required directories | |
| # - environment: ATOM_HOST_MOUNT_DIRS must match volumes | |
| # - governance: AUTONOMOUS gate enforced in HostShellService | |
| # - audit: All commands logged to ShellSession table | |