app:
  id: penpot
  name: Penpot
  version: 2.0.0
  description: Open-source design and prototyping platform. Design tools for teams.
  
  container:
    image: penpotapp/frontend:2.13.3
    image_signature: cosign://...
    pull_policy: if-not-present
    
  dependencies:
    - storage: 10Gi
    
  resources:
    cpu_limit: 4
    memory_limit: 4Gi
    disk_limit: 10Gi
    
  security:
    capabilities: []
    readonly_root: true
    network_policy: isolated
    apparmor_profile: penpot
    
  ports:
    - host: 8089
      container: 80
      protocol: tcp  # Web UI
    
  volumes:
    - type: bind
      source: /var/lib/archipelago/penpot
      target: /app/data
      options: [rw]
      
  environment:
    - PENPOT_PUBLIC_URI=http://localhost:8089
    - PENPOT_DATABASE_URI=postgresql://penpot:penpot@penpot-db:5432/penpot
    - PENPOT_REDIS_URI=redis://penpot-redis:6379
    
  health_check:
    type: http
    endpoint: http://localhost:8089
    path: /api/health
    interval: 30s
    timeout: 5s
    retries: 3