sashatrask
110 lines
2.6 KiB
YAML
110 lines
2.6 KiB
YAML
name: truf-docker
|
|
|
|
x-runtime: &runtime
|
|
image: truf-local:runtime
|
|
build:
|
|
context: .
|
|
target: runtime
|
|
read_only: true
|
|
user: "10001:10001"
|
|
cap_drop: [ALL]
|
|
security_opt: [no-new-privileges:true]
|
|
volumes:
|
|
- data:/data
|
|
tmpfs:
|
|
- /run/truf:rw,nosuid,nodev,noexec,size=64m,mode=0700,uid=10001,gid=10001
|
|
- /tmp:rw,nosuid,nodev,noexec,size=128m,mode=1777
|
|
cpus: 2.0
|
|
mem_limit: 6g
|
|
pids_limit: 512
|
|
shm_size: 256m
|
|
stop_signal: SIGTERM
|
|
stop_grace_period: 10m
|
|
logging:
|
|
driver: json-file
|
|
options:
|
|
max-size: "16m"
|
|
max-file: "4"
|
|
|
|
services:
|
|
provision:
|
|
<<: *runtime
|
|
user: "0:0"
|
|
cap_add: [CHOWN, DAC_OVERRIDE, FOWNER]
|
|
network_mode: none
|
|
command: [provision]
|
|
restart: "no"
|
|
|
|
runtime:
|
|
<<: *runtime
|
|
volumes:
|
|
- type: volume
|
|
source: data
|
|
target: /data
|
|
- type: bind
|
|
source: /etc/truf/runtime
|
|
target: /data/config
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: /etc/truf/worker-packages
|
|
target: /data/worker-packages
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: /var/lib/truf/runtime-document-candidates
|
|
target: /data/runtime-document-candidates
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: /run/truf/host-agent.sock
|
|
target: /run/truf/host-agent.sock
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: /var/lib/truf/host-agent/results
|
|
target: /data/host-agent-results
|
|
read_only: true
|
|
bind:
|
|
create_host_path: false
|
|
- type: bind
|
|
source: /run/truf-postgres
|
|
target: /run/truf-postgres
|
|
bind:
|
|
create_host_path: false
|
|
depends_on:
|
|
provision:
|
|
condition: service_completed_successfully
|
|
command: [run, --config, /data/config/config.yaml]
|
|
restart: "on-failure:3"
|
|
healthcheck:
|
|
test: [CMD, /usr/local/bin/python3, -I, -S, -B, /opt/truf/app/container_runtime.py, health, --config, /data/config/config.yaml]
|
|
interval: 30s
|
|
timeout: 15s
|
|
start_period: 240s
|
|
retries: 3
|
|
|
|
test:
|
|
image: truf-local:test
|
|
build:
|
|
context: .
|
|
target: test
|
|
profiles: [test]
|
|
read_only: true
|
|
user: "10001:10001"
|
|
cap_drop: [ALL]
|
|
security_opt: [no-new-privileges:true]
|
|
network_mode: none
|
|
tmpfs:
|
|
# These tests intentionally execute temporary venv and askpass fixtures.
|
|
- /tmp:rw,exec,nosuid,nodev,size=512m,mode=1777
|
|
cpus: 2.0
|
|
mem_limit: 3g
|
|
pids_limit: 512
|
|
|
|
volumes:
|
|
data:
|