| # 知識庫系統 V5 — PRD §35.2 安全選項 | |
| # read_only / cap_drop ALL / no-new-privileges / 寫入限定 mount + tmpfs | |
| services: | |
| app: | |
| build: . | |
| image: kbv5:latest | |
| container_name: kbv5 | |
| user: "1000:1000" | |
| read_only: true | |
| cap_drop: | |
| - ALL | |
| security_opt: | |
| - no-new-privileges:true | |
| tmpfs: | |
| - /tmp:size=64m | |
| - /home/kb:size=16m # pip cache、user-level temp | |
| volumes: | |
| # MD 為事實來源（§6）— 必須可寫 | |
| - ./vault:/app/vault | |
| # SQLite DB + history + PII centroids + AI 詞典等 — 必須可寫 | |
| - ./data:/app/data | |
| # 前端靜態檔（mockup HTML 由映像帶入；如要熱替換可掛 ro） | |
| # - ./static:/app/static:ro | |
| ports: | |
| - "127.0.0.1:8000:8000" # 預設綁本機；用 reverse proxy 對外 | |
| environment: | |
| KBV5_ENV: prod | |
| KBV5_RATE_LIMIT: "1" | |
| KBV5_SEED: "1" | |
| env_file: | |
| - .env.prod # JWT_SECRET / AI 金鑰等敏感資料 | |
| restart: unless-stopped | |
| healthcheck: | |
| test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8000/healthz"] | |
| interval: 30s | |
| timeout: 5s | |
| start_period: 15s | |
| retries: 3 | |