services:
  game:
    build: .
    image: idle-clicker:latest
    ports:
      - "${GAME_PORT:-8080}:8080"
    restart: unless-stopped
    init: true

    # Hardening: the game needs no writes, no privileges and no extra capabilities.
    user: "1000:1000"
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 100
    mem_limit: 128m