# Rootless-podman overlay for this host (no docker daemon here).
#
# The base file runs the app as `user: 1000:1000`. Under rootless podman the
# default userns maps container uid 1000 to a subordinate host uid (100999),
# which cannot write the bind-mounted checkout (owned by host uid 1000), so
# uvicorn crashes on startup with PermissionError and nginx never starts.
# Running as container root maps back to the invoking host user (retoor),
# restoring write access. This stays unprivileged on the host because the
# container is rootless.
#
# (A `userns_mode: keep-id` service override was tried first, but podman
# rejects `--userns` together with `--pod`, and podman-compose places all
# services in one pod.)
#
# Kept as an overlay (not inlined) so rootful `docker compose` keeps using
# the non-root app user from the base file.
#
# Usage (prefer the make targets - a bare `up` without this file recreates a
# crashing app, see PODMAN.md):
#   make podman-up
#   podman-compose -f docker-compose.yml -f docker-compose.podman.yml up -d

services:
  app:
    user: "0:0"