Snipo

services:
  snipo:
    image: ghcr.io/mohamedelashri/snipo:latest
    container_name: snipo
    restart: unless-stopped
    # Security: Container runs as non-root user (UID 1000) with:
    # - Read-only root filesystem
    # - All Linux capabilities dropped
    # - No privilege escalation allowed
    ports:
      - "8080:8080"
    volumes:
      - snipo_data:/data
      # Temporary directory for read-only root filesystem
      - type: tmpfs
        target: /tmp
        tmpfs:
          size: 10485760 # 10MB
          mode: 1777
    # Security options
# ...