compose.yml

x-dev-service-defaults: &dev-service-defaults
  init: true
  stop_grace_period: 30s
  ulimits:
    nofile:
      soft: ${COMPOSE_NOFILE_SOFT:-65536}
      hard: ${COMPOSE_NOFILE_HARD:-65536}
  logging:
    driver: json-file
    options:
      max-size: ${COMPOSE_LOG_MAX_SIZE:-10m}
      max-file: "${COMPOSE_LOG_MAX_FILE:-3}"

services:
  postgres:
    <<: *dev-service-defaults
    build:
      context: .
      dockerfile: containers/postgres/Dockerfile
    image: ${POSTGRES_IMAGE:-exploit-hunter/postgres:18-pgvector-age}
    container_name: exploit-hunter-postgres
    restart: unless-stopped
    mem_limit: ${POSTGRES_MEM_LIMIT:-1g}
    cpus: ${POSTGRES_CPUS:-1}
    pids_limit: ${POSTGRES_PIDS_LIMIT:-512}
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: agent_security
    ports:
      - "127.0.0.1:${POSTGRES_PORT:-5432}:5432"
    volumes:
      - postgres18-data:/var/lib/postgresql
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d agent_security"]
      interval: 5s
      timeout: 5s
      retries: 12
      start_period: 10s

  minio:
    <<: *dev-service-defaults
    image: minio/minio:latest
    container_name: exploit-hunter-minio
    restart: unless-stopped
    mem_limit: ${MINIO_MEM_LIMIT:-1g}
    cpus: ${MINIO_CPUS:-1}
    pids_limit: ${MINIO_PIDS_LIMIT:-512}
    command: server /data --address ":9000" --console-address ":9001"
    environment:
      # Use the same standard AWS credential boundary as the app unless
      # MinIO-specific local credentials are explicitly supplied.
      MINIO_ROOT_USER: ${MINIO_ACCESS_KEY:-${AWS_ACCESS_KEY_ID:-exploit-hunter}}
      MINIO_ROOT_PASSWORD: ${MINIO_SECRET_KEY:-${AWS_SECRET_ACCESS_KEY:-exploit-hunter-secret}}
    ports:
      - "59000:9000"
      - "59001:9001"
    volumes:
      - minio-data:/data
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 10s
      timeout: 5s
      retries: 8
      start_period: 15s

  juice-shop:
    <<: *dev-service-defaults
    # Hard Juice Shop: https://github.com/ExploitHunterApp/hard-juice-shop
    image: ${JUICE_SHOP_IMAGE:-ghcr.io/justsml/juice-shop:latest}
    container_name: ${JUICE_SHOP_CONTAINER_NAME:-exploit-hunter-juice-shop}
    restart: unless-stopped
    mem_limit: ${JUICE_SHOP_MEM_LIMIT:-1g}
    cpus: ${JUICE_SHOP_CPUS:-1}
    pids_limit: ${JUICE_SHOP_PIDS_LIMIT:-512}
    environment:
      NODE_OPTIONS: ${JUICE_SHOP_NODE_OPTIONS:---max-old-space-size=768}
      NODE_CONFIG: ${NODE_CONFIG:-}
      APPLICATION_NAME: ${APPLICATION_NAME:-Hard Juice Shop}
      APPLICATION_DOMAIN: ${APPLICATION_DOMAIN:-}
      APPLICATION_PRIVACY_CONTACT_EMAIL: ${APPLICATION_PRIVACY_CONTACT_EMAIL:-}
      APPLICATION_WELCOME_MESSAGE: ${APPLICATION_WELCOME_MESSAGE:-}
      APPLICATION_SHOW_GITHUB_LINKS: ${APPLICATION_SHOW_GITHUB_LINKS:-}
      APPLICATION_SHOW_SUPPORT_LINKS: ${APPLICATION_SHOW_SUPPORT_LINKS:-}
      APPLICATION_TRANSLATION_OVERRIDES: ${APPLICATION_TRANSLATION_OVERRIDES:-}
      APPLICATION_CSS_VARIABLES: ${APPLICATION_CSS_VARIABLES:-}
      PRODUCT_OVERRIDES: ${PRODUCT_OVERRIDES:-}
    ports:
      - "${JUICE_SHOP_HOST:-0.0.0.0}:${JUICE_SHOP_PORT:-3323}:${JUICE_SHOP_CONTAINER_PORT:-3000}"
    healthcheck:
      test:
        [
          "CMD",
          "/nodejs/bin/node",
          "-e",
          "fetch('http://127.0.0.1:3000').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
        ]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 30s

volumes:
  minio-data:
  postgres18-data: