proper productionize project

2026-07-15 23:54:53 -07:00
parent b8850c87a4
commit edb6d2b5b4
46 changed files with 11346 additions and 1560 deletions
@@ -3,6 +3,20 @@ services:
    build: .
    restart: unless-stopped
    network_mode: host
+    user: "${APP_UID:-1000}:${APP_GID:-1000}"
+    read_only: true
+    tmpfs:
+      - /tmp:size=16m,noexec,nosuid,nodev
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
    volumes:
      # 复制 config.toml.example 为 config.toml 并填入真实配置后再启动。
      - ./config.toml:/app/config.toml:ro
+    healthcheck:
+      test: ["CMD", "curl", "--fail", "--silent", "http://127.0.0.1:9719/health"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 20s