services:
  playdash:
    build: .
    image: playdash
    container_name: playdash
    # PID-1 duties (zombie reaping of Chromium's many child processes).
    init: true
    restart: unless-stopped
    # Chromium uses shared memory heavily; do not shrink this.
    shm_size: 1g
    # Cage on DRM/KMS: needs the GPU card device. If only a render node
    # exists on the host, adjust WLR_DRM_DEVICES below accordingly.
    devices:
      - /dev/dri/card0:/dev/dri/card0
    # Access to the DRM/render device without running as root. Set RENDER_GID
    # in .env to your host's `render` group id (getent group render).
    group_add:
      - "${RENDER_GID:-994}"
    # Cage provides the display (Wayland on DRM); playdash supervises Chrome.
    entrypoint: ["/usr/bin/cage", "--", "/usr/local/bin/playdash"]
    environment:
      PLAYDASH_KEY: ${PLAYDASH_KEY}
      PLAYDASH_PORT: 7391
      PLAYDASH_START_URL: ${PLAYDASH_START_URL:-about:blank}
      # Proven browser on this stack (see README for the google-chrome option).
      PLAYDASH_CHROME_BIN: /usr/bin/chromium
      # Display-stack specifics (Cage/wlroots + software rendering).
      # --no-sandbox is required under Docker's default seccomp profile; see
      # README "sandbox" note for how to drop it with a seccomp exception.
      PLAYDASH_CHROME_ARGS: >-
        --ozone-platform=wayland --disable-gpu --no-sandbox
      XDG_RUNTIME_DIR: /run/user/10001
      LIBSEAT_BACKEND: builtin
      SEATD_VTBOUND: "0"
      WLR_BACKENDS: drm
      WLR_DRM_DEVICES: /dev/dri/card0
      WLR_RENDERER: pixman
      WLR_LIBINPUT_NO_DEVICES: "1"
    ports:
      - "7391:7391"
    volumes:
      - playdash-profile:/data/chrome-profile

volumes:
  playdash-profile: