diff --git a/docker/compose.internal.yml b/docker/compose.internal.yml
new file mode 100644
index 0000000..964b2aa
--- /dev/null
+++ b/docker/compose.internal.yml
@@ -0,0 +1,44 @@
+version: "3.9"
+name: metal-kompanion
+
+networks:
+  komnet: {}   # runner ↔ tor ↔ ollama
+  netpub: {}   # egress to internet for tor + ollama
+
+services:
+  tor:
+    image: dperson/torproxy
+    restart: unless-stopped
+    command: -a 0.0.0.0
+    networks: [komnet, netpub]
+
+  ollama:
+    image: ollama/ollama:latest
+    restart: unless-stopped
+    volumes:
+      - ollama:/root/.ollama            # persist models once
+      - /home/kompanion/ollama-modelfiles:/modelfiles   # your custom Modelfiles/LoRA
+    networks: [komnet, netpub]          # can reach registry.ollama.ai
+
+  runner:
+    image: python:3.11-slim
+    restart: unless-stopped
+    working_dir: /app
+    environment:
+      XDG_STATE_HOME: /state
+      XDG_CONFIG_HOME: /config
+      XDG_CACHE_HOME: /cache
+      ALL_PROXY: socks5h://tor:9050
+      NO_PROXY: ollama,localhost,127.0.0.1
+      OLLAMA_BASE: http://ollama:11434   # talk to container by DNS name
+    depends_on: [ollama, tor]
+    volumes:
+      - /home/kompanion/.local/state/kompanion:/state/kompanion
+      - /home/kompanion/.config/kompanion:/config/kompanion:ro
+      - /home/kompanion/.cache/kompanion:/cache/kompanion
+      - /home/kompanion/metal-kompanion-runtime:/app:ro
+    command: ["python3","kom_runner.py"]
+    networks: [komnet]
+
+volumes:
+  ollama: {}
diff --git a/docker/compose.yml b/docker/compose.yml
deleted file mode 100644
index e5dd394..0000000
--- a/docker/compose.yml
+++ /dev/null
@@ -1,24 +0,0 @@
-version: "3.9"
-name: metal-kompanion-host
-
-services:
-  runner:
-    image: python:3.11-slim
-    restart: unless-stopped
-    working_dir: /app
-    extra_hosts: ["host.docker.internal:host-gateway"]
-    environment:
-      XDG_STATE_HOME: /state
-      XDG_CONFIG_HOME: /config
-      XDG_CACHE_HOME: /cache
-      # talk to host services:
-      OLLAMA_BASE: http://host.docker.internal:11434
-      ALL_PROXY:    socks5h://host.docker.internal:9050
-      NO_PROXY:     host.docker.internal,127.0.0.1,localhost
-    volumes:
-      - /home/kompanion/.local/state/kompanion:/state/kompanion
-      - /home/kompanion/.config/kompanion:/config/kompanion:ro
-      - /home/kompanion/.cache/kompanion:/cache/kompanion
-      - /home/kompanion/metal-kompanion-runtime:/app:ro
-    command: ["python3","kom_runner.py"]
-