docker-compose.yml

# zshot server with Chromium's sandbox on and the strictest container settings.
#
#   docker run --rm --entrypoint cat scaleassembly/zshot-server:0.49.1 \
#     /usr/share/zshot/zshot-seccomp.json > zshot-seccomp.json
#   docker compose up -d
#
# Upgrade with `docker compose pull && docker compose up -d`.
services:
  zshot:
    image: ${ZSHOT_IMAGE:-scaleassembly/zshot-server:0.49.1}
    restart: unless-stopped
    ports:
      - "${ZSHOT_PORT:-3000}:3000"
    environment:
      # Your license goes here. Either put ZSHOT_LICENSE=your-key in a .env
      # file beside this one, which Compose reads on its own, or replace the
      # default below with the key.
      ZSHOT_LICENSE: ${ZSHOT_LICENSE:-}
      # Optional: require this bearer token on every request.
      ZSHOT_SERVER_TOKEN_AUTH: ${ZSHOT_SERVER_TOKEN_AUTH:-}
    security_opt:
      - seccomp=./zshot-seccomp.json
      - no-new-privileges=true
    cap_drop: [ALL]
    read_only: true
    tmpfs: [/tmp]
    # Memory and concurrency are in tension: every concurrent render is a
    # browser instance, and video renders need the most. Your workload sets
    # the requirement. See https://zshot-cli.com/reference/flags/server/server-max-concurrency/
    # for sizing per slot.
    deploy:
      resources:
        limits:
          memory: 2g
          pids: 512