compose.yaml

services:
  url_to_pdf:
    # Build locally; resulting image still named below for reuse/tagging.
    build:
      context: .
      dockerfile: Dockerfile
    image: deno-url-to-pdf
    ports:
      - "3000:3000"
    environment:
      PORT: "3000"
      CHROMIUM_PATH: "/usr/bin/chromium-browser"
      XDG_CONFIG_HOME: "/tmp/chrome-config"
      DENO_DIR: "/deno-dir"
    # read_only: true
    tmpfs:
      - /tmp:rw,exec                   # Chromium temporary files (needs exec)
      - /run:rw,nosuid,nodev           # Runtime state
      - /home/deno/.cache:rw,nosuid,nodev  # Avoid polluting image layer
      # - /deno-dir:rw,nosuid,nodev      # Writable DENO cache (DENO_DIR set in Dockerfile)
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: unless-stopped
    healthcheck:
      # Using curl for health check (fail fast, silent, show errors if any)
      test: ["CMD-SHELL", "curl -fsS http://localhost:3000/healthz || exit 1"]