services:
  app:
    build:
      context: .
    image: caiwuzongzhang:local
    ports:
      - "${APP_PORT:-4173}:4173"
    environment:
      APP_HOST: 0.0.0.0
      APP_PORT: 4173
    init: true
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777
    security_opt:
      - no-new-privileges:true