fix(runtime): harden smoke and credential boundaries

2026-08-04 16:05:06 +00:00
parent 09d849de07
commit c49989631f
16 changed files with 517 additions and 8 deletions
@@ -1,10 +1,14 @@
 services:
+  postgres:
+    restart: "no"
+  redis:
+    restart: "no"
  runtime:
    user: ${DEV_UID:-1000}:${DEV_GID:-1000}
    environment:
      CORE_SOURCE_MODE: bind
      CORE_BIND_ROOT: /workspace/core2026
-      RUNTIME_MODE: ${RUNTIME_MODE:-development}
+      RUNTIME_MODE: development
      VITE_PREVIEW_ALLOWED_HOSTS: '*'
    volumes:
      - ${CORE_DEV_PATH:-../core2026}:/workspace/core2026
@@ -17,6 +21,12 @@ services:
      timeout: 5s
      retries: 30
      start_period: 5m
+    mem_limit: ${DEV_RUNTIME_MEMORY_LIMIT:-4g}
+    memswap_limit: ${DEV_RUNTIME_MEMORY_SWAP_LIMIT:-4g}
+    cpus: ${DEV_RUNTIME_CPU_LIMIT:-4}
+    pids_limit: ${DEV_RUNTIME_PIDS_LIMIT:-256}
+    restart: "no"
  caddy:
    environment:
      SITE_ADDRESS: :80
+    restart: "no"