v3

2026-09-13 20:05:01 +01:00
commit 51d6d76b53
12 changed files with 1559 additions and 0 deletions
@@ -0,0 +1,66 @@
+# =============================================================================
+# Cipher Barcode Studio — docker-compose
+# Usage:  docker compose up -d --build
+# Access: http://localhost:8080
+# =============================================================================
+
+services:
+  cipher:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: cipher-barcode-studio:1.0.0
+    container_name: cipher-barcode-studio
+    restart: unless-stopped
+
+    ports:
+      # Host:Container — change the left side to publish on a different port
+      - "${HOST_PORT:-8080}:8080"
+
+    # ---------- Runtime hardening ----------
+    # Run as the non-root user baked into the image (UID 101)
+    user: "101:101"
+    # Read-only root filesystem with explicit tmpfs for nginx's scratch dirs
+    read_only: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=16m
+      - /var/cache/nginx:rw,noexec,nosuid,size=16m
+      - /var/run:rw,noexec,nosuid,size=4m
+    # Drop every Linux capability; nginx-unprivileged on port 8080 needs none
+    cap_drop:
+      - ALL
+    # Stop the container from gaining new privileges
+    security_opt:
+      - no-new-privileges:true
+
+    # ---------- Resource limits ----------
+    deploy:
+      resources:
+        limits:
+          cpus: "0.50"
+          memory: 128M
+        reservations:
+          cpus: "0.05"
+          memory: 32M
+
+    # ---------- Logging ----------
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "5m"
+        max-file: "3"
+
+    # ---------- Healthcheck (overrides Dockerfile so we can tune it) ----------
+    healthcheck:
+      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1:8080/healthz"]
+      interval: 30s
+      timeout: 3s
+      retries: 3
+      start_period: 5s
+
+    networks:
+      - cipher-net
+
+networks:
+  cipher-net:
+    driver: bridge