app:
  id: ollama
  name: Ollama
  version: 0.1.0
  description: Run large language models locally. Privacy-preserving AI on your node.
  
  container:
    image: ollama/ollama:0.6.2
    image_signature: cosign://...
    pull_policy: if-not-present
    
  dependencies:
    - storage: 50Gi  # Models can be large
    
  resources:
    cpu_limit: 4
    memory_limit: 8Gi  # LLMs need lots of RAM
    disk_limit: 50Gi
    
  security:
    capabilities: []
    readonly_root: false  # Ollama needs write access for models
    no_new_privileges: true
    user: 1000
    seccomp_profile: default
    network_policy: isolated
    apparmor_profile: ollama
    
  ports:
    - host: 11434
      container: 11434
      protocol: tcp  # API
    
  volumes:
    - type: bind
      source: /var/lib/archipelago/ollama
      target: /root/.ollama
      options: [rw]
      
  environment:
    - OLLAMA_HOST=0.0.0.0:11434
    - OLLAMA_KEEP_ALIVE=24h
    
  health_check:
    type: http
    endpoint: http://localhost:11434
    path: /api/tags
    interval: 30s
    timeout: 10s
    retries: 3