docker-compose.yml

# Funscript Player – your settings live in .env (copy .env.example once). This file rarely needs changes.
# Update: docker compose pull && docker compose up -d   ·   build it yourself: docker compose up -d --build
name: funscript-player
services:
  funscript-player:
    image: ghcr.io/scripthost/funscript-player:${PLAYER_VERSION:-latest}
    build: .
    container_name: Funscript-Player
    restart: unless-stopped
    env_file:
      - path: .env
        required: false
    ports:
      - "${PLAYER_BIND:-0.0.0.0}:${PLAYER_PORT:-8080}:8080"
    volumes:
      - funscript-data:/app/data                # everything the player saves – back up this volume
      - ${MEDIA:-./media}:/media:ro             # video folders: every subfolder becomes a source
      # Extra scripts next to Stash videos (clip.soft.funscript) – remove the "#" and set MEDIA_STASH in .env:
      # - ${MEDIA_STASH}:/media/Stash:ro

    # Intel graphics (Quick Sync) for a faster HQ stream – only if the host HAS Intel graphics:
    # remove the "#" in front of both lines and set RENDER_GID in .env (getent group render).
    # devices: [/dev/dri:/dev/dri]
    # group_add: ["${RENDER_GID:-992}"]

    # Hardening: never root, read-only, no Linux capabilities, memory cap (protects Stash and other containers)
    user: "${PUID:-1000}:${PGID:-1000}"
    read_only: true
    tmpfs: [/tmp]
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    mem_limit: ${PLAYER_MEM:-2g}

volumes:
  funscript-data:
    name: funscript-data