services:
  sublarr:
    image: ghcr.io/abrechen2/sublarr:${VERSION:-dev}
    build:
      context: .
      args:
        VERSION: ${VERSION:-dev}
        PUID: ${PUID:-1000}
        PGID: ${PGID:-1000}
    container_name: sublarr
    ports:
      - "127.0.0.1:${SUBLARR_PORT:-5765}:5765"
    volumes:
      - ./config:/config
      - ${SUBLARR_MEDIA_PATH:-/media}:/media:rw
    read_only: true
    tmpfs:
      - /tmp
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 4G
        reservations:
          cpus: '0.5'
          memory: 512M
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      # Removed SETGID and SETUID -- not needed for gunicorn/Flask
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"