diff --git a/.push.sh b/.push.sh
new file mode 100644
index 0000000..9664b35
--- /dev/null
+++ b/.push.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd /home/kompanion/metal-kompanion
+[ -d .git ] || git init
+ git config user.name Χγφτ
diff --git a/docker/.env b/docker/.env
new file mode 100644
index 0000000..489f7d9
--- /dev/null
+++ b/docker/.env
@@ -0,0 +1 @@
+# reserved for future per-env overrides
diff --git a/docker/compose.yml b/docker/compose.yml
index 8216af9..221d1ec 100644
--- a/docker/compose.yml
+++ b/docker/compose.yml
@@ -1,30 +1,48 @@
 version: "3.9"
+name: metal-kompanion
+networks:
+  komnet:
+    driver: bridge
+    internal: true
+
 services:
-  tor:
-    image: dperson/torproxy:latest
-    command: -n
-    restart: unless-stopped
+  # Local model host
   ollama:
     image: ollama/ollama:latest
+    restart: unless-stopped
+    ports: ["127.0.0.1:11434:11434"]
     volumes:
       - ollama:/root/.ollama
+    networks: [komnet]
+
+  # TOR proxy (SOCKS5)
+  tor:
+    image: dperson/torproxy
     restart: unless-stopped
+    command: -a 0.0.0.0
+    ports: ["127.0.0.1:9050:9050"]
+    networks: [komnet]
+
+  # Companion runner (Python) — reads tasks.jsonl, writes journal/ledger
   runner:
-    build:
-      context: ..
-      dockerfile: docker/runner/Dockerfile
+    image: python:3.11-slim
+    restart: unless-stopped
+    working_dir: /app
     environment:
       XDG_STATE_HOME: /state
       XDG_CONFIG_HOME: /config
       XDG_CACHE_HOME: /cache
-      OLLAMA_BASE_URL: http://ollama:11434
+      # Route all egress through TOR by default (except localhost)
       ALL_PROXY: socks5h://tor:9050
-      NO_PROXY: localhost,127.0.0.1,ollama
-    volumes:
-      - /home/kompanion/.local/state/kompanion:/state
-      - /home/kompanion/.config/kompanion:/config
-      - /home/kompanion/.cache/kompanion:/cache
+      NO_PROXY: 127.0.0.1,localhost
     depends_on: [ollama, tor]
-    restart: unless-stopped
+    volumes:
+      - /home/kompanion/.local/state/kompanion:/state/kompanion
+      - /home/kompanion/.config/kompanion:/config/kompanion:ro
+      - /home/kompanion/.cache/kompanion:/cache/kompanion
+      - /home/kompanion/metal-kompanion-runtime:/app:ro
+    command: ["python3","kom_runner.py"]
+    networks: [komnet]
+
 volumes:
   ollama: