services:
  goboxd:
    build:
      context: .
      args:
        # Comma-separated language subset, e.g. LANGS=py3,c,swift.
        # "all" (default) installs every language.
        LANGS: ${LANGS:-all}
        # Stamped into /info build_info (see internal/buildinfo).
        COMMIT: ${COMMIT:-dev}
        VERSION: ${VERSION:-0.2.0}
    ports:
      - "8080:8080"
    privileged: true # Required for nsjail to create namespaces
    # cgroup v2: goboxd auto-detects a writable cgroup2 hierarchy at startup
    # and enforces per-jail memory/pids limits with it, falling back to rlimit
    # enforcement where unavailable (e.g. Docker Desktop, or containers whose
    # cgroup namespace has no delegated controllers). On Linux hosts run the
    # container with --cgroupns=host (docker run) to expose the host hierarchy
    # and enable cgroup v2; compose on this version accepts no cgroupns field.
    # See docs/security.md for the deployment matrix.
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: "2"
          memory: 2G
    volumes:
      - ./tests/testcases:/app/testcases:ro
    environment:
      - PORT=8080
      - GOBOXD_MAX_CPUS=2
      - GOBOXD_MAX_JOBS=4
      # Advertise only the languages the image was built with.
      # Follows the LANGS used at build time; empty = all.
      - GOBOXD_LANGS=${LANGS:-}
      # GOBOXD_EXCLUDE_LANGS removes languages from the advertised registry
      # (the image keeps them). Empty = all languages advertised.
      - GOBOXD_EXCLUDE_LANGS=${GOBOXD_EXCLUDE_LANGS:-}