docker-compose-guardrails
Docker Compose Guardrails
Treat an omitted resource limit as a defect for every long-running service unless a documented exception names its owner and duration.
Resolve Policy
uv run python <skill-root>/scripts/resolve.py --cwd <project-root> --task deploy
Read the returned instructions when instructions_id changes. Project resource classes, budgets, topology, and checks belong in .agents/skills-config/docker-compose-guardrails/; see project_config.md. Detailed generic deployment policy is in deploy.md.
Enforce Boundaries
For each long-running service set finite service-level cpus, mem_limit, and pids_limit, plus an appropriate restart policy. Do not rely only on deploy.resources; local Compose enforcement varies. Values may be provisional when workload evidence is absent, but name the measurement that will refine them.
Allow unbounded resources only for a short-lived manual task with an explicit reason and owner. Compose limits are ceilings, not minimum guarantees. When selected workloads need minimum protection, also apply the resolved host cgroup policy and verify every relevant ancestor.