# Root-Dateisystem nur lesbar. Schreiben darf Next.js nur in /tmp und in
# seinen Cache (.next/cache), beides emptyDir.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: apicore-frontend
spec:
  template:
    spec:
      automountServiceAccountToken: false
      volumes:
        - name: tmp
          emptyDir: {}
        - name: next-cache
          emptyDir: {}
      containers:
        - name: apicore-frontend
          securityContext:
            readOnlyRootFilesystem: true
          volumeMounts:
            - name: tmp
              mountPath: /tmp
            - name: next-cache
              mountPath: /app/.next/cache
          resources:
            requests:
              cpu: 30m
              memory: 128Mi
            limits:
              cpu: 300m
              memory: 256Mi