harden delivery pipeline and production runtime

docker-compose.yml

@@ -2,7 +2,22 @@ services:
   api:
     build: .
     ports:
-      - "8000:8000"
+      - "127.0.0.1:8000:8000"
     env_file:
-      - .env
-    restart: unless-stopped
+      - path: .env
+        required: false
+    environment:
+      SILLYHOME_MODEL_STORE: /app/data/models
+    volumes:
+      - model-data:/app/data/models
+    read_only: true
+    tmpfs:
+      - /tmp
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    restart: unless-stopped
+
+volumes:
+  model-data: