diff --git a/.gitignore b/.gitignore
index 976b269..fa3f990 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
 deploy/.env
 deploy/secrets/
 deploy/state/
+deploy/volume/
 app/dist/
 app/node_modules/
 dist/
diff --git a/deploy/Dockerfile b/deploy/Dockerfile
index e05f8ca..3549c3b 100644
--- a/deploy/Dockerfile
+++ b/deploy/Dockerfile
@@ -43,7 +43,7 @@ CMD ["node", "/opt/ci-agents/dist/application/controller/main.js"]
 
 FROM runtime AS executor
 ARG TARGETARCH=amd64
-ARG OPENCODE_VERSION=1.17.18
+ARG OPENCODE_VERSION=1.18.2
 ARG GITEA_MCP_VERSION=1.3.0
 USER root
 RUN npm install --global --omit=dev "opencode-ai@${OPENCODE_VERSION}" \
diff --git a/deploy/compose.yaml b/deploy/compose.yaml
index 4640c4f..a1cec73 100644
--- a/deploy/compose.yaml
+++ b/deploy/compose.yaml
@@ -44,8 +44,8 @@ services:
         uid: "10001"
         gid: "10001"
         mode: 0400
-    ports:
-      - "${AGENT_LISTEN_ADDRESS:-127.0.0.1}:${AGENT_HTTP_PORT:-8080}:8080"
+    networks:
+      - gitea-common
     healthcheck:
       test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8080/readyz').then(r=>{if(!r.ok)process.exit(1)})"]
       interval: 10s
@@ -86,3 +86,7 @@ secrets:
     file: ${GITEA_READ_TOKEN_FILE:-./secrets/gitea-read-token}
   gitea_webhook_secret:
     file: ${GITEA_WEBHOOK_SECRET_FILE:-./secrets/gitea-webhook-secret}
+
+networks:
+  gitea-common:
+    external: true