Spaces:
Running
Running
Deploy Aureon OS (deploy/selfhost stack: nginx edge + fusion API x2 + console + HNC organ + redis + postgres; paper mode) (part 7)
c626614 verified | # SaaS image protection preflights. | |
| # Both services intentionally return HOLD and expose no ports or networks. | |
| services: | |
| operator-protection-preflight: | |
| build: | |
| context: .. | |
| dockerfile: deploy/operator.Dockerfile | |
| image: aureon-operator-protection-preflight:local | |
| restart: "no" | |
| command: [] | |
| network_mode: "none" | |
| read_only: true | |
| tmpfs: | |
| - /tmp:rw,noexec,nosuid,nodev,size=16m | |
| cap_drop: | |
| - ALL | |
| security_opt: | |
| - no-new-privileges:true | |
| # Held operator contract. Names are recorded only. This preflight injects | |
| # none of them, starts no listener, and does not arm orders. | |
| # AUREON_OPERATOR_ENV | |
| # AUREON_OPERATOR_API_KEY: "${AUREON_OPERATOR_API_KEY:? | |
| # AUREON_OPERATOR_RATE_RPS | |
| # AUREON_OPERATOR_RATE_BURST | |
| # AUREON_OPERATOR_MAX_BODY | |
| # AUREON_OPERATOR_TRUSTED_PROXY_CIDRS | |
| # AUREON_OPERATOR_HTTP_PROCESSES | |
| # AUREON_OPERATOR_REPLICAS | |
| # replicas: 1 | |
| frontend-protection-preflight: | |
| build: | |
| context: .. | |
| dockerfile: deploy/frontend.Dockerfile | |
| image: aureon-frontend-protection-preflight:local | |
| restart: "no" | |
| command: [] | |
| network_mode: "none" | |
| read_only: true | |
| tmpfs: | |
| - /tmp:rw,noexec,nosuid,nodev,size=16m | |
| cap_drop: | |
| - ALL | |
| security_opt: | |
| - no-new-privileges:true | |