services:
  stevedore:
    build:
      context: .
      dockerfile: Dockerfile
    image: stevedore:latest
    container_name: stevedore
    # Satisfies stevedore's own init enforcement when it deploys itself. tini
    # becomes PID 1; stevedore's built-in zombie reaper stays as a no-op
    # fallback (it only activates when os.Getpid() == 1).
    init: true
    environment:
      STEVEDORE_ROOT: /opt/stevedore
      STEVEDORE_DB_KEY_FILE: /opt/stevedore/system/db.key
      STEVEDORE_SOURCE_REPO: ${STEVEDORE_SOURCE_REPO:-}
      STEVEDORE_SOURCE_REF: ${STEVEDORE_SOURCE_REF:-}
    # cgroup: host is required so /sys/fs/cgroup exposes the host's full cgroup
    # hierarchy (not the per-container namespaced view). The PID-pressure
    # watchdog reads pids.current / pids.max for each managed container's
    # cgroup from there.
    cgroup: host
    # Mount Docker socket to allow Docker operations from within the container.
    # /sys/fs/cgroup is read-only so the watchdog can only read PID counters.
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ${STEVEDORE_HOST_ROOT:-/opt/stevedore}:/opt/stevedore
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    # Keep the container running for interactive use
    # Comment out the 'command' line if you want to run the default CMD from Dockerfile
    # command: tail -f /dev/null
    restart: unless-stopped