Your infrastructure.
Beautifully under control.

01# Application deployment example. Supply reviewed application images first.02# Web contract: HTTP on port 3000. API contract: Node.js, HTTP on port 8080,03# GET /health, and support for DB_PASSWORD_FILE. Public routing is configured04# separately in DOCKOCK. Pin image digests before a production deployment.05name: application-stack06 07services:08  web:09    image: ${WEB_IMAGE:?Set a reviewed web image}10    init: true11    restart: unless-stopped12    read_only: true13    tmpfs: [/tmp]14    cap_drop: [ALL]15    security_opt: [no-new-privileges:true]16    expose: ["3000"]17    networks: [edge, application]18    depends_on:19      api:20        condition: service_healthy21 22  api:23    image: ${API_IMAGE:?Set a reviewed Node.js API image}24    init: true25    restart: unless-stopped26    read_only: true27    tmpfs: [/tmp]28    cap_drop: [ALL]29    security_opt: [no-new-privileges:true]30    expose: ["8080"]31    networks: [application, data]32    environment:33      DB_HOST: database34      DB_NAME: application35      DB_USER: application36      DB_PASSWORD_FILE: /run/secrets/db_password37    secrets: [db_password]38    depends_on:39      database:40        condition: service_healthy41    healthcheck:42      test: ["CMD", "node", "-e", "fetch('http://localhost:8080/health').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"]43      interval: 15s44      timeout: 5s45      retries: 346      start_period: 20s47 48  database:49    image: postgres:16-alpine50    restart: unless-stopped51    networks: [data]52    environment:53      POSTGRES_DB: application54      POSTGRES_USER: application55      POSTGRES_PASSWORD_FILE: /run/secrets/db_password56    secrets: [db_password]57    volumes:58      - postgres_data:/var/lib/postgresql/data59    healthcheck:60      test: ["CMD-SHELL", "pg_isready -U $$POSTGRES_USER -d $$POSTGRES_DB"]61      interval: 10s62      timeout: 5s63      retries: 564      start_period: 20s65 66networks:67  edge: {}68  application: {}69  data:70    internal: true71 72volumes:73  postgres_data: {}74 75secrets:76  db_password:77    file: ./secrets/db_password