docker-compose.yml

# Single compose file. Every knob comes from `.env` — copy .env.example to .env
# and edit. See DEPLOY.md.
#
#   docker compose pull && docker compose up -d     # registry image (preferred)
#   docker compose build && docker compose up -d    # build the app image locally
#
# This service REQUIRES an NVIDIA GPU and driver. whisper-cli is dynamically
# linked against libcuda.so.1, which the NVIDIA Container Toolkit injects, so
# without a GPU the binary cannot start at all — there is no CPU fallback in the
# container. For local development on a machine without an NVIDIA GPU, run the
# binary natively instead (`make build`); see README.md.
name: transcriber

services:
  transcriber:
    image: ${IMAGE:-ghcr.io/bcc-code/transcriber:latest}
    build:
      context: .
      args:
        # Prebuilt whisper.cpp/CUDA base. Bump this to change whisper or CUDA
        # versions; it is built separately by .github/workflows/whisper-base.yml.
        BASE_IMAGE: ${BASE_IMAGE:-ghcr.io/bcc-code/whisper-cuda:v1.8.6-cuda12.6.3}
    restart: unless-stopped

    # BIND_ADDR=0.0.0.0 preserves the previous behaviour: the API has no
    # authentication, so anything that can reach this port can read and write
    # any path visible inside the container. Firewall it, or set BIND_ADDR to
    # an internal interface.
    ports:
      - "${BIND_ADDR:-0.0.0.0}:${PORT:-8888}:${PORT:-8888}"

    command:
      - "-port=${PORT:-8888}"
      - "-workers=${WORKERS:-2}"
      - "-callback-workers=${CALLBACK_WORKERS:-2}"
      - "-default-model=${DEFAULT_MODEL:-whisper-cpp-large-v3}"
      - "-default-language=${DEFAULT_LANGUAGE:-}"
      - "-job-timeout=${JOB_TIMEOUT:-30m}"
      - "-max-terminal-jobs=${MAX_TERMINAL_JOBS:-200}"
      - "-log-format=${LOG_FORMAT:-json}"

    volumes:
      # ggml model cache — first job downloads ~3 GB, this keeps it.
      - models:/var/cache/transcriber
      # Audio in / transcripts out. Job requests carry absolute paths that are
      # resolved *inside* the container, so host and container paths must match.
      # STORAGE_PATH must already exist on the host: Docker otherwise creates
      # it as an empty root-owned directory and every job fails with ENOENT.
      - ${STORAGE_PATH:-/mnt/storage}:${STORAGE_PATH:-/mnt/storage}
      # Optional default prompt (vocabulary hints). Uncomment to use.
      # - ./prompt.txt:/app/prompt.txt:ro

    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:${PORT:-8888}/healthz"]
      interval: 30s
      timeout: 5s
      start_period: 15s
      retries: 3

    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: all
              capabilities: [gpu]

volumes:
  models: