67 lines
1.8 KiB
YAML
67 lines
1.8 KiB
YAML
|
# =============================================================================
|
||
|
|
# Cipher Barcode Studio — docker-compose
|
||
|
|
# Usage: docker compose up -d --build
|
||
|
|
# Access: http://localhost:8080
|
||
|
|
# =============================================================================
|
||
|
|
|
||
|
|
services:
|
||
|
|
cipher:
|
||
|
|
build:
|
||
|
|
context: .
|
||
|
|
dockerfile: Dockerfile
|
||
|
|
image: cipher-barcode-studio:1.0.0
|
||
|
|
container_name: cipher-barcode-studio
|
||
|
|
restart: unless-stopped
|
||
|
|
|
||
|
|
ports:
|
||
|
|
# Host:Container — change the left side to publish on a different port
|
||
|
|
- "${HOST_PORT:-8080}:8080"
|
||
|
|
|
||
|
|
# ---------- Runtime hardening ----------
|
||
|
|
# Run as the non-root user baked into the image (UID 101)
|
||
|
|
user: "101:101"
|
||
|
|
# Read-only root filesystem with explicit tmpfs for nginx's scratch dirs
|
||
|
|
read_only: true
|
||
|
|
tmpfs:
|
||
|
|
- /tmp:rw,noexec,nosuid,size=16m
|
||
|
|
- /var/cache/nginx:rw,noexec,nosuid,size=16m
|
||
|
|
- /var/run:rw,noexec,nosuid,size=4m
|
||
|
|
# Drop every Linux capability; nginx-unprivileged on port 8080 needs none
|
||
|
|
cap_drop:
|
||
|
|
- ALL
|
||
|
|
# Stop the container from gaining new privileges
|
||
|
|
security_opt:
|
||
|
|
- no-new-privileges:true
|
||
|
|
|
||
|
|
# ---------- Resource limits ----------
|
||
|
|
deploy:
|
||
|
|
resources:
|
||
|
|
limits:
|
||
|
|
cpus: "0.50"
|
||
|
|
memory: 128M
|
||
|
|
reservations:
|
||
|
|
cpus: "0.05"
|
||
|
|
memory: 32M
|
||
|
|
|
||
|
|
# ---------- Logging ----------
|
||
|
|
logging:
|
||
|
|
driver: "json-file"
|
||
|
|
options:
|
||
|
|
max-size: "5m"
|
||
|
|
max-file: "3"
|
||
|
|
|
||
|
|
# ---------- Healthcheck (overrides Dockerfile so we can tune it) ----------
|
||
|
|
healthcheck:
|
||
|
|
test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1:8080/healthz"]
|
||
|
|
interval: 30s
|
||
|
|
timeout: 3s
|
||
|
|
retries: 3
|
||
|
|
start_period: 5s
|
||
|
|
|
||
|
|
networks:
|
||
|
|
- cipher-net
|
||
|
|
|
||
|
|
networks:
|
||
|
|
cipher-net:
|
||
|
|
driver: bridge
|