name: truf-worker

services:
  worker:
    image: truf-remote-worker:linux-x86_64
    container_name: truf-worker
    restart: unless-stopped
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 256
    stop_grace_period: 10m
    tmpfs:
      - /tmp:rw,nosuid,nodev,noexec,size=128m,mode=1777
    environment:
      XDG_DATA_HOME: /data/client
      XDG_STATE_HOME: /data/state-base
    volumes:
      - truf-worker-data:/data
    command:
      - run

volumes:
  truf-worker-data:
    name: truf-worker-data