name: truf-docker

x-runtime: &runtime
  image: truf-local:runtime
  build:
    context: .
    target: runtime
  read_only: true
  user: "10001:10001"
  cap_drop: [ALL]
  security_opt: [no-new-privileges:true]
  volumes:
    - data:/data
  tmpfs:
    - /run/truf:rw,nosuid,nodev,noexec,size=64m,mode=0700,uid=10001,gid=10001
    - /tmp:rw,nosuid,nodev,noexec,size=128m,mode=1777
  cpus: 2.0
  mem_limit: 6g
  pids_limit: 512
  shm_size: 256m
  stop_signal: SIGTERM
  stop_grace_period: 10m
  logging:
    driver: json-file
    options:
      max-size: "16m"
      max-file: "4"

services:
  provision:
    <<: *runtime
    user: "0:0"
    cap_add: [CHOWN, DAC_OVERRIDE, FOWNER]
    network_mode: none
    command: [provision]
    restart: "no"

  runtime:
    <<: *runtime
    volumes:
      - type: volume
        source: data
        target: /data
      - type: bind
        source: /etc/truf/runtime
        target: /data/config
        read_only: true
        bind:
          create_host_path: false
      - type: bind
        source: /etc/truf/worker-packages
        target: /data/worker-packages
        read_only: true
        bind:
          create_host_path: false
      - type: bind
        source: /var/lib/truf/runtime-document-candidates
        target: /data/runtime-document-candidates
        bind:
          create_host_path: false
      - type: bind
        source: /run/truf/host-agent.sock
        target: /run/truf/host-agent.sock
        read_only: true
        bind:
          create_host_path: false
      - type: bind
        source: /var/lib/truf/host-agent/results
        target: /data/host-agent-results
        read_only: true
        bind:
          create_host_path: false
      - type: bind
        source: /run/truf-postgres
        target: /run/truf-postgres
        bind:
          create_host_path: false
    depends_on:
      provision:
        condition: service_completed_successfully
    command: [run, --config, /data/config/config.yaml]
    restart: "on-failure:3"
    healthcheck:
      test: [CMD, /usr/local/bin/python3, -I, -S, -B, /opt/truf/app/container_runtime.py, health, --config, /data/config/config.yaml]
      interval: 30s
      timeout: 15s
      start_period: 240s
      retries: 3

  test:
    image: truf-local:test
    build:
      context: .
      target: test
    profiles: [test]
    read_only: true
    user: "10001:10001"
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    network_mode: none
    tmpfs:
      # These tests intentionally execute temporary venv and askpass fixtures.
      - /tmp:rw,exec,nosuid,nodev,size=512m,mode=1777
    cpus: 2.0
    mem_limit: 3g
    pids_limit: 512

volumes:
  data: