docker-compose.pull.example.yml

# Pull and run: the published, signed image from GHCR.
# Save this as docker-compose.yml, run `docker compose up -d kipple`, and open http://127.0.0.1:1919
# to create your account. No .env is needed: everything is set in the browser.
#
# Set the image tag below to the newest version on https://github.com/WPTK/Kipple/releases.
#
# The port is published on this machine only. Create your account first: until one exists, anyone who can reach
# the port can create it. Then use "1919:1919" to reach Kipple from your LAN, or your Tailscale address
# ("100.x.y.z:1919:1919"). A named volume is ready to use; a bind mount at /data
# needs `chown 65532:65532` on the host directory first. The build-from-source variant is in
# docker-compose.example.yml. See docs/deploy.md.

services:
  kipple:
    image: ghcr.io/wptk/kipple:1.5.1
    # A fixed name, so `docker logs kipple` and `docker exec kipple /kipple ...` work
    # (without it Compose names the container <project>-kipple-1).
    container_name: kipple
    restart: unless-stopped
    ports: ["127.0.0.1:1919:1919"]
    volumes: ["kipple_data:/data"]
    # Kipple finishes shutting down within 25 s of SIGTERM; 30 s leaves margin.
    stop_grace_period: 30s
    # Hard memory and process caps; GOMEMLIMIT makes the Go GC work harder before the cap is hit.
    mem_limit: 256m
    pids_limit: 200
    environment: ["GOMEMLIMIT=64MiB"]
    read_only: true
    tmpfs: ["/tmp:size=64m,mode=1777"]
    cap_drop: [ALL]
    security_opt: ["no-new-privileges:true"]
    logging:
      driver: json-file
      options: {max-size: "10m", max-file: "3"}
volumes:
  kipple_data: