name: kinosail-player

services:
  kinosail:
    image: ghcr.io/kinosail/kinosail-player:latest
    restart: unless-stopped
    stop_grace_period: 30s
    init: true
    user: "10001:10001"
    pids_limit: 256
    read_only: true
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    ports:
      - "38127:38127"
    environment:
      KINOSAIL_DATA_DIR: /config
      KINOSAIL_CACHE_DIR: /cache
      KINOSAIL_MEDIA_DIR: /media
      KINOSAIL_BACKUP_DIR: /backups
    volumes:
      - player-config:/config
      - player-cache:/cache
      - player-backups:/backups
      - type: bind
        source: "${KINOSAIL_MEDIA_PATH:?Set an existing absolute media path}"
        target: /media
        read_only: true
        bind:
          create_host_path: false
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=256m
      - /run:rw,noexec,nosuid,nodev,size=16m
    healthcheck:
      test: ["CMD", "kinosail", "healthcheck"]
      interval: 30s
      timeout: 15s
      retries: 3

volumes:
  player-config:
  player-cache:
  player-backups: