services:
  api:
    build: { context: ., dockerfile: backend/Dockerfile }
    env_file: .env
    environment:
      APP_ENV: development
      DATA_DIR: /data
      SANDBOX_URL: http://sandbox:8080
      FRONTEND_DIST: /nonexistent   # in dev the web container serves the SPA
      CORS_ORIGINS: http://localhost:5173
    volumes: [uqo-data:/data]
    ports: ["8190:8190"]
    depends_on: [sandbox]

  web:
    image: node:22-alpine
    working_dir: /app
    command: sh -c "npm install && npm run dev -- --host"
    volumes: ["./frontend:/app"]
    environment: { VITE_API_URL: /api/v1 }
    ports: ["5173:5173"]

  sandbox:
    build: ./sandbox-runner
    network_mode: none          # no egress from executed code (matches prod NetworkPolicy)
    read_only: true
    tmpfs: ["/tmp:size=100m", "/workspace:size=100m"]
    security_opt: ["no-new-privileges:true"]
    cap_drop: [ALL]
    pids_limit: 64
    mem_limit: 512m
    cpus: 0.5

volumes:
  uqo-data: {}