name: cve-2026-103849-lab

services:
  db:
    image: mariadb:11.4@sha256:250e1609e93c0e6aecf64bfbab2d84d5e89d2481540fe77447ff6c855c3b1873
    command:
      - --max_allowed_packet=64M
      - --optimizer_use_condition_selectivity=1
      - --optimizer_switch=rowid_filter=off
    environment:
      MARIADB_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-rootpw}
      MARIADB_DATABASE: ${MYSQL_DATABASE:-magento}
      MARIADB_USER: ${MYSQL_USER:-magento}
      MARIADB_PASSWORD: ${MYSQL_PASSWORD:-magento}
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      timeout: 5s
      retries: 30
    volumes:
      - dbdata:/var/lib/mysql
    restart: unless-stopped

  opensearch:
    image: opensearchproject/opensearch:2.19.0@sha256:1f8b88245a6af61e7aa500afe0e87d43401e4b33140bb47230a919428ce3f7cb
    environment:
      discovery.type: single-node
      bootstrap.memory_lock: "true"
      OPENSEARCH_JAVA_OPTS: -Xms1g -Xmx1g
      DISABLE_SECURITY_PLUGIN: "true"
      DISABLE_INSTALL_DEMO_CONFIG: "true"
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - osdata:/usr/share/opensearch/data
    restart: unless-stopped

  redis:
    image: redis:7-alpine@sha256:858f009f9709ce576febc734aa78b8f6d624b82571f9ddb6bda4377c833b3499
    restart: unless-stopped

  mailhog:
    image: mailhog/mailhog:v1.0.1@sha256:8d76a3d4ffa32a3661311944007a415332c4bb855657f4f6c57996405c009bea
    platform: linux/amd64
    ports:
      - "127.0.0.1:${MAILHOG_PORT:-18097}:8025"
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped

  php:
    build:
      context: .
      dockerfile: php/Dockerfile
    working_dir: /var/www/html
    init: true
    environment:
      MAGENTO_VERSION: ${MAGENTO_VERSION:-2.4.9}
      EXPECTED_MAGENTO_REVISION: ${EXPECTED_MAGENTO_REVISION:-755e34dd689021c5165db9d35ecff74f7dc51527}
      MAGENTO_HOST: 127.0.0.1
      LAB_PORT: ${LAB_PORT:-18096}
      MAGENTO_ADMIN_USER: ${MAGENTO_ADMIN_USER:-admin}
      MAGENTO_ADMIN_PASSWORD: ${MAGENTO_ADMIN_PASSWORD:-Admin123!}
      MAGENTO_ADMIN_EMAIL: ${MAGENTO_ADMIN_EMAIL:-admin@example.test}
      BACKEND_FRONTNAME: ${BACKEND_FRONTNAME:-admin}
      MYSQL_DATABASE: ${MYSQL_DATABASE:-magento}
      MYSQL_USER: ${MYSQL_USER:-magento}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD:-magento}
      COMPOSER_MEMORY_LIMIT: -1
    healthcheck:
      test: ["CMD-SHELL", "test -f /var/www/html/.cve-2026-103849-lab-ready"]
      interval: 15s
      timeout: 5s
      retries: 160
      start_period: 30s
    volumes:
      - magesrc:/var/www/html
      - ./:/lab:ro
    depends_on:
      db:
        condition: service_healthy
      opensearch:
        condition: service_started
      redis:
        condition: service_started
      mailhog:
        condition: service_started
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped

  nginx:
    image: nginx:1.27-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10
    command:
      - /bin/sh
      - -c
      - |
        until [ -f /var/www/html/nginx.conf.sample ]; do sleep 2; done
        exec nginx -g 'daemon off;'
    ports:
      - "127.0.0.1:${LAB_PORT:-18096}:80"
    volumes:
      - magesrc:/var/www/html:ro
      - ./nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
    depends_on:
      php:
        condition: service_healthy
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped

volumes:
  dbdata:
  osdata:
  magesrc:

networks:
  default:
    ipam:
      config:
        - subnet: 10.210.103.0/24