services:
  agent:
    build: .
    restart: unless-stopped
    env_file: .env
    ports:
      - "7080:8080"
    volumes:
      - agent-data:/app/data
      - ./knowledge:/app/knowledge:ro
    depends_on:
      ollama:
        condition: service_started
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777

  ollama:
    image: ollama/ollama:latest
    restart: unless-stopped
    volumes:
      - ollama-data:/root/.ollama
    # GPU users can add the appropriate device/runtime stanza for their platform.

volumes:
  agent-data:
  ollama-data: