compose.yaml

services:
  git-backup:
    image: ghcr.io/neurekadev/git-backup:edge
    container_name: git-backup
    env_file:
      - .env
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    # entrypoint.sh starts as root and drops to PUID:PGID: chown needs CHOWN, and gosu (not setuid)
    # needs SETGID/SETUID to make the switch. Everything else stays dropped.
    cap_add:
      - CHOWN
      - SETGID
      - SETUID
    networks:
      - git-backup
    volumes:
      - data:/app/data
      # Mount the config directory, not the file: a single-file bind mount pins the container to the
      # original inode, so host edits saved by write-and-rename never reach the container and hot reload
      # silently does nothing. A directory mount lets the container see every edit.
      - ./config:/app/config:ro
    restart: unless-stopped

networks:
  git-backup:
    name: git-backup

volumes:
  data: