docker-compose.yml

# Mode B, for a team that wants a shared cache and provider keys off individual machines.
#
# Optional. The extension ships in Mode A and does the whole job on the device; nothing here
# is required to use truthlens, and we do not run a hosted instance of it.
#
# Note what is absent: no log driver collecting request bodies, no analytics sidecar, no
# volume that would persist what anyone read. A proxy for a tool like this is otherwise an
# excellent record of its users' reading, and that is a thing worth not building.
services:
  api:
    build:
      context: .
      dockerfile: apps/api/Dockerfile
    ports:
      - '127.0.0.1:8000:8000'
    environment:
      # Provider keys are supplied by the operator and are never baked into the image.
      TRUTHLENS_LOG_LEVEL: ${TRUTHLENS_LOG_LEVEL:-info}
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    restart: unless-stopped