#[test]
fn compose_is_a_hardened_read_only_sidecar() {
    let compose = include_str!("../compose.example.yml");
    assert!(compose.contains("minecraft-data:/data:ro"));
    assert!(compose.contains("read_only: true"));
    assert!(compose.contains("cap_drop: [ALL]"));
    assert!(compose.contains("no-new-privileges:true"));
    assert!(!compose.contains("docker.sock"));
    assert!(!compose.contains("ports:"));
}
#[test]
fn runtime_has_no_node_and_runs_non_root() {
    let dockerfile = include_str!("../Dockerfile");
    let runtime = dockerfile
        .split("FROM debian:bookworm-slim AS runtime")
        .nth(1)
        .unwrap();
    assert!(!runtime.contains("npm "));
    assert!(!runtime.contains("node "));
    assert!(runtime.contains("USER 10001:10001"));
}