services:
  runner:
    image: robotail/gitea-light-runner:0.2.13-hardened
    container_name: gitea-light-runner
    restart: unless-stopped
    user: "10001:10001"
    read_only: true
    working_dir: /work
    entrypoint: ["/sbin/tini", "--", "/usr/local/bin/act_runner"]
    command: ["daemon", "--config", "/config.yaml"]
    stop_grace_period: 75s
    cpus: "1.0"
    mem_limit: 768m
    memswap_limit: 1g
    pids_limit: 256
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    environment:
      HOME: /work
    volumes:
      - ./data/.runner:/registration/.runner:ro
      - ./config.yaml:/config.yaml:ro
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev,size=128m
      - /work:rw,nosuid,nodev,size=384m,uid=10001,gid=10001,mode=0700
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: "3"