squid writes access.log and cache.log to files, not to stdout - the previous
commit already explains why - which puts them entirely outside the json-file
driver's max-size the rest of the stack just got. Left alone they grow forever
on the one service in this file without read_only: true.
Bounded the same way /tmp is bounded elsewhere: a size-capped tmpfs, lost on
restart rather than kept and unbounded. Needs uid/gid=13 because squid drops to
its own "proxy" user before opening these files, and a tmpfs mount point
defaults to root-owned like any other - which failed loudly the first time,
with squid's own answer to an unopenable log being fatal rather than a quieter
fallback. Compose's long tmpfs syntax has no field for that, so this uses the
raw mount-options string the top-level tmpfs: list already uses elsewhere in
this file.
Verified under compose itself, not a bare docker run: no errors at start, and
the log files it creates are owned by proxy:proxy as expected.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Lucio Lelii
44ca1c5435