# OpenClaw Kids Instance - Locked Down & Safe
# Run with: docker-compose -f docker-compose.kids.yml up -d

version: '3.8'

services:
  openclaw-kids:
    image: ghcr.io/openclaw/openclaw:latest
    container_name: openclaw-kids
    restart: unless-stopped
    ports:
      - "18790:18789"  # Different port from main instance
    environment:
      - OPENCLAW_CONFIG=/config/openclaw-kids.json
      - OPENCLAW_STATE_DIR=/state
    volumes:
      - ./config:/config:ro
      - ./state:/state
      - ./workspace-kids:/workspace-kids
      - /var/run/docker.sock:/var/run/docker.sock:ro  # For sandboxing
    networks:
      - openclaw-kids
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETGID
      - SETUID

networks:
  openclaw-kids:
    driver: bridge