# A single controller only. Stop and confirm the old writer terminated before up.
services:
  carstate:
    image: ${CARSTATE_IMAGE:-carstate:local}
    build:
      context: .
      target: production
      args:
        BUILD_HASH: ${BUILD_HASH:-unknown}
    init: true
    restart: unless-stopped
    env_file:
      - path: .env
        required: false
    environment:
      CARSTATE_DRY_RUN: ${CARSTATE_DRY_RUN:-false}
    volumes:
      - type: bind
        source: ./config
        target: /app/config
        read_only: true
        bind:
          create_host_path: false
    ports:
      - "127.0.0.1:${CARSTATE_PROD_HTTP_PORT:-3000}:3000"
    read_only: true
    tmpfs:
      - /tmp:size=16m,mode=1777
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    stop_grace_period: 20s