name: searxng
services:
  searxng:
    # Pinned tag: JSON API behavior verified against this build.
    image: docker.io/searxng/searxng:2026.10.19-81371861f
    restart: unless-stopped
    # Loopback-only: the MCP server runs on the same host. The JSON API is
    # unauthenticated; do NOT bind this port to a public interface.
    ports:
      - '127.0.0.1:8888:8080'
    environment:
      - SEARXNG_SECRET=${SEARXNG_SECRET:?set SEARXNG_SECRET in .env (openssl rand -hex 32)}
    volumes:
      - ./searxng:/etc/searxng/:Z