version: '3.8'

services:
  launcher:
    image: nearone/mpc-launcher@sha256:{{LAUNCHER_IMAGE_HASH}}

    container_name: launcher

    environment:
      - PLATFORM=TEE
      - DOCKER_CONTENT_TRUST=1
      - DEFAULT_IMAGE_DIGEST=sha256:{{DEFAULT_IMAGE_DIGEST_HASH}}

    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/run/dstack.sock:/var/run/dstack.sock
      - /tapp:/tapp:ro
      - shared-volume:/mnt/shared:rw

    security_opt:
      - no-new-privileges:true

    read_only: true

    tmpfs:
      - /tmp

volumes:
  shared-volume:
    name: shared-volume