services:
  api:
    image: ${REGISTRY_IMAGE:?REGISTRY_IMAGE required}:${IMAGE_TAG:?IMAGE_TAG required}
    restart: always
    environment:
      APP_ENV: production
      ADMIN_COOKIE_SECURE: 'true'
      NOTIFICATION_WORKER_ENABLED: 'true'
    read_only: true
    tmpfs:
      - /tmp:size=64m,noexec,nosuid
    security_opt:
      - no-new-privileges:true