curo1305
e117a33a73
- frontend prod: USER root for adduser, then USER appuser (1001:1001); fixes build failure caused by nginx-unprivileged already setting USER nginx - docker-compose: frontend user updated to 1001:1001 (was 101:101) - CLAUDE.md: add infrastructure change protocol (update README + test both stacks after any Dockerfile/compose/nginx change); fix stale passlib ref - README: container table shows nginx-unprivileged image, UID column, internal port 8080 note; Current State notes all containers run as non-root Both dev and prod stacks tested and verified (health, login, /users/me, frontend serving, all containers confirmed non-root via docker inspect). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
54 lines
1.8 KiB
YAML
54 lines
1.8 KiB
YAML
services:
|
|
|
|
# ── Database ────────────────────────────────────────────────────────────────
|
|
db:
|
|
image: postgres:16-alpine
|
|
user: "70:70" # postgres user UID:GID in alpine image (fixed by image)
|
|
restart: unless-stopped
|
|
environment:
|
|
POSTGRES_USER: ${POSTGRES_USER:-postgres}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-password}
|
|
POSTGRES_DB: ${POSTGRES_DB:-destroying_sap}
|
|
ports:
|
|
- "5432:5432"
|
|
volumes:
|
|
- postgres_data:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres}"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 10
|
|
|
|
# ── Backend (management) ────────────────────────────────────────────────────
|
|
backend:
|
|
build:
|
|
context: ./backend
|
|
dockerfile: Dockerfile
|
|
network: host
|
|
user: "1001:1001"
|
|
restart: unless-stopped
|
|
env_file: ./backend/.env
|
|
environment:
|
|
DATABASE_URL: postgresql+asyncpg://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-password}@db:5432/${POSTGRES_DB:-destroying_sap}
|
|
ports:
|
|
- "8000:8000"
|
|
depends_on:
|
|
db:
|
|
condition: service_healthy
|
|
|
|
# ── Frontend (UI) ────────────────────────────────────────────────────────────
|
|
frontend:
|
|
build:
|
|
context: ./frontend
|
|
dockerfile: Dockerfile
|
|
network: host
|
|
user: "1001:1001"
|
|
restart: unless-stopped
|
|
ports:
|
|
- "80:8080"
|
|
depends_on:
|
|
- backend
|
|
|
|
volumes:
|
|
postgres_data:
|