name: scienfactory
services:
  app:
    build:
      context: .
      dockerfile: containers/app.Dockerfile
    ports:
      - '127.0.0.1:4312:4310'
    env_file:
      - .env.local
    environment:
      # The browser's exposed port is checked independently from the listen port.
      PUBLIC_ORIGIN: http://127.0.0.1:4312
      LAB_CONCURRENCY: 2
    volumes:
      - research-data:/data
      - /var/run/docker.sock:/var/run/docker.sock
    read_only: true
    tmpfs:
      - /tmp:size=64m
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    mem_limit: 2g
    cpus: 2
    pids_limit: 256
    restart: unless-stopped
    healthcheck:
      test:
        [
          'CMD',
          'bun',
          '-e',
          "const r=await fetch('http://127.0.0.1:4310/api/health');process.exit(r.ok?0:1)",
        ]
      interval: 15s
      timeout: 5s
      retries: 3
volumes:
  research-data: