services:
  shuziren:
    build:
      context: .
    container_name: shuziren
    restart: unless-stopped
    init: true
    ports:
      - "9000:9000"
    environment:
      HOST: 0.0.0.0
      PORT: 9000
      LOG_DIRECTORY: /app/logs
    volumes:
      - ./logs:/app/logs
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:9000/healthz').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]
      interval: 30s
      timeout: 5s
      start_period: 15s
      retries: 3