services:
  ocsentinel-mcp:
    build: .
    container_name: ocsentinel-mcp
    restart: unless-stopped
    env_file: .env
    # The first version is intentionally only reachable through an SSH tunnel.
    ports:
      - "127.0.0.1:8091:8080"
    networks:
      - ocsentinel-network
    read_only: true
    tmpfs:
      - /tmp
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL

networks:
  ocsentinel-network:
    external: true
    name: n8n_n8n-network