services:
  scanner:
    build: .
    image: security-scanner:0.1
    ports:
      - "8000:8000"
    env_file:
      - .env
    environment:
      # Bind to all interfaces inside the container; the port mapping controls exposure.
      HOST: 0.0.0.0
      PORT: 8000
    volumes:
      # Persist the vulnerability cache across restarts.
      - vuln-cache:/app/.cache/vuln
    restart: unless-stopped

volumes:
  vuln-cache: