# resume — runtime container (Phase 3 §3.2).
#
# Copied into each release directory by deploy/deploy.sh; the release's .env
# supplies APP_VERSION (the image tag). Never edited on the host — change it
# here, in git, and deploy again.
#
# Limits that are not negotiable (AGENTS.md §4.3):
#   mem_limit == memswap_limit == 120m   -> the container cannot touch host swap
#   ports 127.0.0.1:$PORT:8096           -> Caddy on .35 is the only public listener
#
# .13 has every default Docker address pool subnetted out (many projects), so a
# single-container service uses the host bridge and publishes its port rather
# than creating a project network. Same pattern as compass-teams-nhs.

name: resume

services:
  app:
    image: resume/app:${APP_VERSION}
    container_name: resume-app
    restart: unless-stopped
    network_mode: bridge
    ports:
      - "127.0.0.1:${APP_PORT:-8096}:8096"
    environment:
      PORT: "8096"
      APP_VERSION: "${APP_VERSION}"
      # Mode B values arrive in Phase 5 from ~/.config/environment.d/ — never here.
    mem_limit: 120m
    memswap_limit: 120m
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8096/healthz"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 5s