Talon on Docker: one command to a running daemon

Talon’s Docker support just graduated from experimental to production-ready. The new deploy/Dockerfile and deploy/docker-compose.yaml give you a hardened, self-contained Talon daemon in one command.

What changed

The previous Docker setup was a proof-of-concept — a single-stage build with no health checks, no init system, and a warning label that said “not yet production-ready.” Docker v2 replaces that with a proper multi-stage build and a compose file that layers on production hardening.

Here’s what’s new:

Multi-stage build

The image now uses a builder stage to compile TypeScript and a slim production stage that only carries runtime dependencies. The final image is smaller and doesn’t ship devDependencies.

Baked CLIs

Codex CLI and Gemini CLI are pre-installed in the image. You don’t need to install any provider CLI on the host — configure your API keys in .env and the container has everything it needs to run agents through any supported provider.

Health checks

Both the Dockerfile HEALTHCHECK and the compose-level healthcheck verify the daemon is alive. If the process hangs or crashes, Docker (or your orchestrator) can restart it automatically.

Predictable permissions

The container runs as a non-root user with fixed UID/GID 1000:1000. Bind-mount permissions are predictable — chown 1000:1000 on the host and you’re done. Named volumes handle permissions automatically.

Security hardening

The compose file drops all Linux capabilities, sets no-new-privileges:true, mounts the config read-only, and runs as non-root. Optional Docker socket access comes with clear warnings and recommendations for socket proxies and rootless Docker.

Quick start

cp config/talond.example.yaml config/talond.yaml
# Edit with your API keys and channels
cp deploy/.env.example .env
# Fill in your secrets
docker compose -f deploy/docker-compose.yaml up -d

That’s it. One command and Talon is running with health checks, automatic restarts, and resource limits.

What’s next

Docker v2 is the foundation. The next steps are pre-built images on GitHub Container Registry (so you can image: ghcr.io/ivo-toby/talond:latest instead of building locally) and a sandbox image for isolated agent execution.

For the full setup — including socket proxy configuration, rootless Docker, resource tuning, and troubleshooting — see the new Docker deployment guide.