doc-ops-mcp

version: '3.8' services: doc-ops-mcp: build: context: . dockerfile: Dockerfile container_name: doc-ops-mcp restart: unless-stopped # Security configurations user: "1000:1000" # Run as non-root user read_only: true # Read-only root filesystem security_opt: - no-new-privileges:true # Prevent privilege escalation cap_drop: - ALL # Drop all capabilities cap_add: - CHOWN # Only add necessary capabilities - DAC_OVERRIDE - FOWNER # Removed SETGID and SETUID to prevent privilege escalation tmpfs: - /tmp:noexec,nosuid,size=100m # Secure temporary filesystem # Environment variables environment: - NODE_ENV=production - WATERMARK_IMAGE=/app/resources/watermark.png - WATERMARK_TEXT=Confidential - QR_CODE_IMAGE=/app/resources/qrcode.png - PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 # Volumes for file operations volumes: - ./documents:/app/documents:rw,noexec,nosuid,nodev - ./resources:/app/resources:ro - ./temp:/app/temp:rw,noexec,nosuid,nodev - /tmp:/tmp:rw,noexec,nosuid,nodev # Writable temp directory with security restrictions # Networks networks: - mcp-network # Health check healthcheck: test: ['CMD', 'node', 'dist/index.cjs', '--health-check'] interval: 30s timeout: 10s retries: 3 start_period: 40s # Optional: Redis for caching (if needed) redis: image: redis:7-alpine container_name: doc-ops-redis restart: unless-stopped networks: - mcp-network volumes: - redis_data:/data healthcheck: test: ['CMD', 'redis-cli', 'ping'] interval: 30s timeout: 10s retries: 3 # Optional: Nginx for web interface (if needed) nginx: image: nginx:alpine container_name: doc-ops-nginx restart: unless-stopped # Security configurations user: "101:101" # Run as nginx user read_only: true # Read-only root filesystem security_opt: - no-new-privileges:true # Prevent privilege escalation cap_drop: - ALL # Drop all capabilities cap_add: - CHOWN - DAC_OVERRIDE - NET_BIND_SERVICE # Removed SETGID and SETUID to prevent privilege escalation tmpfs: - /tmp:noexec,nosuid,size=50m # Secure temporary filesystem - /var/cache/nginx:noexec,nosuid,size=50m # Secure cache filesystem ports: - '127.0.0.1:8080:80' # Bind to localhost only to prevent external exposure volumes: - ./nginx.conf:/etc/nginx/nginx.conf:ro - ./documents:/var/www/documents:ro - /var/cache/nginx:/var/cache/nginx:rw,noexec,nosuid,nodev # Writable cache directory with security restrictions - /var/run:/var/run:rw,noexec,nosuid,nodev # Writable run directory with security restrictions networks: - mcp-network depends_on: - doc-ops-mcp networks: mcp-network: driver: bridge volumes: redis_data: