Make release compose topology immutable and verifiable

docker-compose.yml

@@ -34,10 +34,8 @@ services:
       redis:
         condition: service_healthy
     command: gunicorn config.wsgi:application --bind 0.0.0.0:8000 --workers ${GUNICORN_WORKERS:-3} --access-logfile - --error-logfile -
-    user: "${LOCAL_UID:-1000}:${LOCAL_GID:-1000}"
+    user: "10001:10001"
     volumes:
-      - .:/app
-      - node_modules_data:/app/node_modules
       - static_data:/app/staticfiles
       - media_data:/app/media
       - runtime_data:/app/runtime
@@ -58,10 +56,9 @@ services:
     env_file:
       - .env
     command: npm run dev
-    user: "${LOCAL_UID:-1000}:${LOCAL_GID:-1000}"
-    volumes:
-      - .:/app
-      - node_modules_data:/app/node_modules
+    user: "10001:10001"
+    profiles:
+      - dev
     restart: unless-stopped
 
   celery_worker:
@@ -76,9 +73,8 @@ services:
       redis:
         condition: service_healthy
     command: celery -A config worker -l info
-    user: "${LOCAL_UID:-1000}:${LOCAL_GID:-1000}"
+    user: "10001:10001"
     volumes:
-      - .:/app
       - runtime_data:/app/runtime
     healthcheck:
       test: ["CMD-SHELL", "celery -A config inspect ping -d celery@$$HOSTNAME | grep -q pong || exit 1"]
@@ -100,9 +96,8 @@ services:
       redis:
         condition: service_healthy
     command: celery -A config beat -l info --schedule=/app/runtime/celerybeat-schedule
-    user: "${LOCAL_UID:-1000}:${LOCAL_GID:-1000}"
+    user: "10001:10001"
     volumes:
-      - .:/app
       - runtime_data:/app/runtime
     healthcheck:
       test: ["CMD-SHELL", "test -f /app/runtime/celerybeat-schedule || exit 1"]