name: libheif-cve-2026-84383-lab

services:
  db:
    image: pgvector/pgvector@sha256:a947c45cdc5906a1bc951f20a8709e321256343ee0f251e4ae00b5e7def4e6da
    platform: linux/amd64
    restart: "no"
    environment:
      POSTGRES_USER: discourse
      POSTGRES_PASSWORD: local_marker_lab_only
      POSTGRES_DB: discourse
      POSTGRES_INITDB_ARGS: "--encoding=UTF8 --locale=C"
    volumes:
      - db_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U discourse -d discourse"]
      interval: 5s
      timeout: 5s
      retries: 24
      start_period: 20s
    networks: [lab]

  redis:
    image: redis@sha256:858f009f9709ce576febc734aa78b8f6d624b82571f9ddb6bda4377c833b3499
    platform: linux/amd64
    restart: "no"
    command: ["redis-server", "--appendonly", "no", "--save", ""]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 5s
      retries: 24
    networks: [lab]

  app:
    platform: linux/amd64
    build:
      context: .
      dockerfile: Dockerfile
      args:
        DISCOURSE_IMAGE: discourse/discourse@sha256:709c40fed5ea6fc8d2945aff57fd9bd4b11629195d1bda03eb3ec55b92e3e44a
        LIBHEIF_VERSION: "1.23.1"
        LIBHEIF_SHA256: 0de0327f60fcd47de90d5654c6fe152232738d60d84fe084ec3e0f35e03b166a
    image: libheif-cve-2026-84383-lab:vulnerable
    restart: "no"
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    # Deliberately no ports section: the vulnerable application is reachable
    # only from the internal Compose network and its own loopback interface.
    expose:
      - "80"
    volumes:
      - app_shared:/shared
    environment:
      DISCOURSE_DB_HOST: db
      DISCOURSE_DB_PORT: "5432"
      DISCOURSE_DB_NAME: discourse
      DISCOURSE_DB_USERNAME: discourse
      DISCOURSE_DB_PASSWORD: local_marker_lab_only
      DISCOURSE_DB_SOCKET: ""
      DISCOURSE_REDIS_HOST: redis
      DISCOURSE_REDIS_PORT: "6379"
      DISCOURSE_HOSTNAME: localhost
      DISCOURSE_DEVELOPER_EMAILS: admin@example.test
      UNICORN_WORKERS: "1"
      LC_ALL: en_US.UTF-8
      LANG: en_US.UTF-8
      LANGUAGE: en_US.UTF-8
    healthcheck:
      test: ["CMD-SHELL", "curl -fsS -o /dev/null http://localhost/ || exit 1"]
      interval: 20s
      timeout: 10s
      retries: 30
      start_period: 900s
    networks: [lab]

networks:
  lab:
    internal: true

volumes:
  app_shared:
  db_data: