File size: 1,195 Bytes
3b1ab70 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 | # 知識庫系統 V5 — PRD §35.2 安全選項
# read_only / cap_drop ALL / no-new-privileges / 寫入限定 mount + tmpfs
services:
app:
build: .
image: kbv5:latest
container_name: kbv5
user: "1000:1000"
read_only: true
cap_drop:
- ALL
security_opt:
- no-new-privileges:true
tmpfs:
- /tmp:size=64m
- /home/kb:size=16m # pip cache、user-level temp
volumes:
# MD 為事實來源（§6）— 必須可寫
- ./vault:/app/vault
# SQLite DB + history + PII centroids + AI 詞典等 — 必須可寫
- ./data:/app/data
# 前端靜態檔（mockup HTML 由映像帶入；如要熱替換可掛 ro）
# - ./static:/app/static:ro
ports:
- "127.0.0.1:8000:8000" # 預設綁本機；用 reverse proxy 對外
environment:
KBV5_ENV: prod
KBV5_RATE_LIMIT: "1"
KBV5_SEED: "1"
env_file:
- .env.prod # JWT_SECRET / AI 金鑰等敏感資料
restart: unless-stopped
healthcheck:
test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8000/healthz"]
interval: 30s
timeout: 5s
start_period: 15s
retries: 3
|