services:
  pinchtab:
    build: .
    container_name: pinchtab
    ports:
      - "9867:9867"
    volumes:
      - pinchtab-data:/data
    environment:
      PINCHTAB_TOKEN: ${PINCHTAB_TOKEN:-}
    restart: unless-stopped
    # Shared memory is critical for Chrome stability
    shm_size: "2gb"
    read_only: true
    tmpfs:
      - /tmp:size=512m,noexec,nosuid,nodev
      - /run:size=64m,noexec,nosuid,nodev
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    # Limit resources
    mem_limit: 2g
    cpus: "2.0"

volumes:
  pinchtab-data: