services:
  shell-mcp:
    build:
      context: .
    image: shell-mcp:mediabox
    container_name: shell-mcp
    restart: unless-stopped
    labels:
      # Local build — there is no registry copy. Without this label watchtower's
      # 05:00 run tries to pull shell-mcp from Docker Hub, gets 401'd, and
      # ntfys the failure every day (first seen 2026-08-02).
      - com.centurylinklabs.watchtower.enable=false
    ports:
      # Published on the LAN so NPM on arrsstack can reach 10.0.1.20:8103.
      # No arrstack_arr_net here — that network lives on the Pi and does not
      # exist on this host. The bearer token is the only gate on this port.
      - "8103:8103"
    environment:
      - BEARER_TOKEN=${MEDIABOX_MCP_BEARER_TOKEN}
      - PORT=8103
      - TZ=${TZ:-America/New_York}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    # pid: host + privileged + nsenter --target 1 is what gives this container
    # full root on the media box host, exactly as on arrsstack.
    pid: host
    privileged: true