name: dtf-staging-readiness

# This composition root is only a network-disabled readiness gate. It does not
# deploy the application or connect to R2, Mercado Pago, freight, Tiny/Olist,
# WhatsApp, a production database, or any other external service.
services:
  readiness:
    build:
      context: .
      dockerfile: local/Dockerfile
    command: python -m local.staging_readiness /config/staging.env
    volumes:
      - ./staging/staging.env:/config/staging.env:ro
    network_mode: none
    read_only: true
    tmpfs: [/tmp]
    init: true
    pids_limit: 64
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]