services:
  creator-hub:
    build: .
    environment:
      DOCKER_GATEWAY_URL: http://docker-gateway:8081
    ports:
      - "127.0.0.1:${CREATORHUB_PORT:-8080}:8080"
    read_only: true
    tmpfs:
      - /tmp:size=16m,noexec,nosuid,nodev
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    depends_on: [docker-gateway]
    networks: [control]
    restart: unless-stopped

  docker-gateway:
    build: .
    command: ["/app/docker-gateway"]
    environment:
      BROWSER_IMAGE: ${BROWSER_IMAGE:-git.ipao.vip/rogee/fingerprint-chromium:148.0.7778.215}
      BROWSER_NETWORK: creatorhub_browser
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    group_add:
      - "${DOCKER_GID:-999}"
    read_only: true
    tmpfs:
      - /tmp:size=16m,noexec,nosuid,nodev
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    networks: [control]
    restart: unless-stopped

networks:
  control:
    name: creatorhub_control
    internal: true