chore(langfuse): 고객사 -12 는 NAT 없는 도커 — host 네트워크 오버라이드(minio 9100, 웹 8915) + dockerd 수동 기동 절차

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

5_django_backend/deploy/langfuse/README.md

@@ -14,11 +14,17 @@ ls -la langfuse-images.tar.gz     # 3~4GB. 메일 안 됨 — 인프라팀 반
 
 ## 2. -12 에서 띄우기
 
+-12 는 systemd 도 iptables 권한도 없는 컨테이너라 도커 데몬을 손으로, NAT 끄고 띄움(부팅 때마다):
+```bash
+nohup dockerd --iptables=false --ip6tables=false --bridge=none > /var/log/dockerd.log 2>&1 &
+```
+도커 설치 자체는 `.deb` 반입 → `dpkg -i` (docker-deb.zip + libseccomp2·netbase·iptables/nftables 묶음 netdeb.zip).
+
 ```bash
 docker load < langfuse-images.tar.gz
 cd /www/abap-ito/code-assistant/5_django_backend/deploy/langfuse
 cp .env.example .env && vi .env      # CHANGEME 전부 교체. NEXTAUTH_URL=http://10.196.81.34:8915
-docker compose -f docker-compose.yml -f docker-compose.customer.yml up -d    # 8915 → 3000 (customer 파일이 포트만 바꿈)
+docker compose -f docker-compose.yml -f docker-compose.customer.yml up -d    # host 네트워크 + 웹 8915 (customer 파일 머리말 참고)
 docker compose ps                    # 6개 healthy 까지 1~2분
 curl -s http://127.0.0.1:3000/api/public/health
 ```

5_django_backend/deploy/langfuse/docker-compose.customer.yml

@@ -1,6 +1,47 @@
-# 고객사 -12 용 — 바깥 포트 8915(놀고 있는 것, 2026-09-22 실측)를 웹 3000 에 붙임.
+# 고객사 -12 용 오버라이드 (2026-09-22 실측 기준)
+#   - -12 는 컨테이너 안이라 iptables 권한이 없음 → dockerd 를 --iptables=false --bridge=none 으로 띄움
+#     → 컨테이너끼리 브릿지 네트워크가 없으니 전부 host 네트워크로, 서로는 127.0.0.1:<포트> 로 부름
+#   - minio 는 clickhouse 와 9000 이 겹쳐 9100 으로 옮김
+#   - 웹은 바깥에서 닿는 빈 포트 8915 로 직접 listen (PORT env)
+#
 #   docker compose -f docker-compose.yml -f docker-compose.customer.yml up -d
 services:
   langfuse-web:
-    ports: !override
+    network_mode: host
-      - 8915:3000
+    ports: !override []
+    environment:
+      PORT: "8915"
+      DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/postgres
+      CLICKHOUSE_URL: http://127.0.0.1:8123
+      CLICKHOUSE_MIGRATION_URL: clickhouse://127.0.0.1:9000
+      REDIS_HOST: 127.0.0.1
+      LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT: http://127.0.0.1:9100
+      LANGFUSE_S3_MEDIA_UPLOAD_ENDPOINT: http://127.0.0.1:9100
+      LANGFUSE_S3_MEDIA_UPLOAD_INTERNAL_ENDPOINT: http://127.0.0.1:9100
+      LANGFUSE_S3_BATCH_EXPORT_ENDPOINT: http://127.0.0.1:9100
+  langfuse-worker:
+    network_mode: host
+    ports: !override []
+    environment:
+      DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/postgres
+      CLICKHOUSE_URL: http://127.0.0.1:8123
+      CLICKHOUSE_MIGRATION_URL: clickhouse://127.0.0.1:9000
+      REDIS_HOST: 127.0.0.1
+      LANGFUSE_S3_EVENT_UPLOAD_ENDPOINT: http://127.0.0.1:9100
+      LANGFUSE_S3_MEDIA_UPLOAD_ENDPOINT: http://127.0.0.1:9100
+      LANGFUSE_S3_BATCH_EXPORT_ENDPOINT: http://127.0.0.1:9100
+  clickhouse:
+    network_mode: host
+    ports: !override []
+  minio:
+    network_mode: host
+    ports: !override []
+    command: -c 'mkdir -p /data/langfuse && minio server --address ":9100" --console-address ":9101" /data'
+    environment:
+      MC_HOST_local: http://minio:miniosecret@127.0.0.1:9100   # healthcheck(mc ready local)가 9100 을 보게
+  redis:
+    network_mode: host
+    ports: !override []
+  postgres:
+    network_mode: host
+    ports: !override []