Run it locally: services, sandbox, knowledge
From `docker compose up` to the hardened code sandbox and the optional knowledge sidecar — what boots, what to lock down, and what is opt-in.
Security posture (read this before exposing the port)
AnyLegal OSS is single-tenant by design. It does not implement authentication: every request runs as a fixed internal user (OSS_USER_ID = 1). Treat it like a desktop app — bind to localhost or to a private network, not to the public internet.