services:
  dot2api:
    build: .
    restart: unless-stopped
    ports:
      - "127.0.0.1:8788:8788"
    volumes:
      - dot2api-data:/data
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=16m
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    stop_grace_period: 45s
volumes:
  dot2api-data: