Gubernator Compose Reference

Gubernator uses standard docker-compose.yml files to deploy stacks, but it extends their functionality by dynamically parsing certain fields for cluster scheduling, auto-naming, and Ingress routing.

This guide explains how to properly write and adjust your docker-compose.yml files for Gubernator.

1. Auto-Naming Stacks

Gubernator allows you to define the name of your stack directly inside the docker-compose.yml file. This means you can deploy your stack without specifying the name in the CLI (gbnt stack deploy -c file.yml) or the Web UI.

Gubernator resolves the stack name in the following order:

stack.name constraint (Highest Priority - Overrides all other methods).
Explicit argument (e.g., CLI [name] argument or Web UI input).
Top-level name property (Native Docker Compose standard).

Option A: The `stack.name` constraint (Recommended)

Because Gubernator makes heavy use of placement constraints for its engine, the recommended way to name your stack is within the first service's placement constraints using stack.name == <name>:

services:
  web:
    image: nginx
    deploy:
      placement:
        constraints:
          - stack.name == my-app-stack

Option B: Top-level `name`

Alternatively, you can use the standard Compose name attribute at the root level of your file:

name: my-app-stack
services:
  web:
    image: nginx

2. Dynamic Stack Variables `{{stack.name}}`

Gubernator includes a real-time templating engine for Compose files. Any occurrence of {{stack.name}} inside your docker-compose.yml will be automatically replaced by the resolved stack name at deployment time.

This is highly useful for internal DNS resolution and naming volumes, ensuring that multiple deployments of the same file don't collide.

services:
  db:
    image: postgres:16
    hostname: postgres
    environment:
      POSTGRES_USER: user

  app:
    image: my-backend
    environment:
      # Automatically resolves to the internal CoreDNS record (e.g., postgres.my-stack.gbnt)
      DB_HOST: postgres.{{stack.name}}.gbnt
    volumes:
      # Ensures this volume is unique per stack
      - data_{{stack.name}}:/app/data

volumes:
  data_{{stack.name}}:

3. Caddy Ingress Routing & Automatic HTTPS

Gubernator automatically configures a high-performance reverse proxy (Caddy) across all cluster nodes. You don't need to manually expose host ports (80:80) for web applications.

Instead, define the ingress.host constraint (or label) in your service. Gubernator dynamically resolves the internal container IPs, configures upstream load balancing, and manages SSL/TLS certificates.

A. Local Domains (`*.gbnt.local`) — Internal TLS

For development and local testing, use a .local, .internal, or *.gbnt.local domain. Gubernator will instruct Caddy to use its internal self-signed Root Certificate Authority (tls internal):

version: '3.8'

services:
  webapp:
    image: nginxdemos/hello:latest
    ports:
      - "80"
    deploy:
      replicas: 2
      placement:
        constraints:
          - stack.name == dev-app
          - ingress.host == myapp.gbnt.local

[!TIP] To trust local certificates in your browser without security warnings, download the Root CA (root.crt) from the Web Dashboard (Caddy Ingress ➔ TLS Certs) or via http://<manager-ip>:4000/v1/caddy/ca.crt.

B. Public Domains (`demo.fiware.app`) — Automatic Let's Encrypt SSL/TLS

When you provide a real, public FQDN (e.g., demo.fiware.app, api.mycompany.com), Gubernator automatically enables Caddy Automatic HTTPS:

Zero-Touch Provisioning: Caddy contacts Let's Encrypt / ZeroSSL via the ACME protocol.
Instant Verification: Caddy validates domain ownership over ports 80/443 (HTTP-01 / TLS-ALPN-01 challenges).
Official X.509 Certificate: A valid, globally trusted certificate is issued, installed, and HTTPS is activated in seconds.
Automatic HTTP ➔ HTTPS Redirect: Port 80 traffic is redirected to port 443 automatically.
Background Auto-Renewal: Certificates are automatically renewed 30 days before expiration.

Example: Deploying a Public Domain Stack

version: '3.8'

services:
  frontend:
    image: nginxdemos/hello:latest
    ports:
      - "80" # Target container port
    deploy:
      replicas: 2
      placement:
        constraints:
          - stack.name == production-demo
          # Public domain for Automatic Let's Encrypt HTTPS:
          - ingress.host == demo.fiware.app
          # (Optional) ACME email for certificate expiration alerts:
          - ingress.email == admin@fiware.app

Alternative Format with Service Labels

You can also use standard Docker Compose labels:

version: '3.8'

services:
  frontend:
    image: nginxdemos/hello:latest
    ports:
      - "80"
    labels:
      gbnt.ingress.host: "demo.fiware.app"
      gbnt.ingress.email: "admin@fiware.app"

C. Ingress Constraints & Labels Reference

Constraint / Label	Description	Example
`ingress.host == <domain>`	Domain to route to this service	`- ingress.host == demo.fiware.app`
`ingress.email == <email>`	ACME contact email for Let's Encrypt	`- ingress.email == admin@fiware.app`
`ingress.tls == internal`	Force Caddy internal self-signed CA	`- ingress.tls == internal`
`ingress.tls == off`	Disable TLS (plain HTTP on port 80 only)	`- ingress.tls == off`
`gbnt.ingress.host`	Label equivalent of `ingress.host`	`gbnt.ingress.host: "demo.fiware.app"`
`gbnt.ingress.email`	Label equivalent of `ingress.email`	`gbnt.ingress.email: "admin@fiware.app"`

D. Prerequisites for Public HTTPS Domains

DNS Record: In your DNS provider (Cloudflare, Route53, GoDaddy, OVH, etc.), configure an A record pointing demo.fiware.app to the public IP of your Gubernator Manager or Ingress node:
```
demo.fiware.app.   300   IN   A   <YOUR_PUBLIC_SERVER_IP>
```
Firewall / Security Group: Ensure inbound traffic on ports 80 (HTTP) and 443 (HTTPS) is open to the internet (0.0.0.0/0).

4. Security Gatekeeper & Image Signing Labels (`gbnt.security.*`)

Gubernator features a native pre-deployment Admission Gatekeeper (The Imperial Seal). Stacks can enforce Zero-Trust container security policies directly in their docker-compose.yml:

version: '3.8'

services:
  secure-payment-api:
    image: company/payment-api:2.1.0
    labels:
      # 1. Require valid cryptographic Cosign signature
      gbnt.security.require-signature: "true"

      # 2. Block deployment if image contains Critical CVEs (CVSS >= 9.0)
      gbnt.security.max-cve-severity: "critical"

      # 3. Block deployment even if no upstream patch exists yet
      gbnt.security.allow-unfixed-cve: "false"

      # 4. (Optional) Enforce signature from a specific key identity
      gbnt.security.signer: "Cluster Administrator"

Security Labels Reference

Label	Values	Description
`gbnt.security.require-signature`	`true`, `false`	Enforces that the container image must be signed with a trusted ECDSA keypair before deployment.
`gbnt.security.max-cve-severity`	`critical`, `high`, `medium`, `none`	Sets the maximum tolerated CVE vulnerability threshold. Deployments exceeding this will be blocked.
`gbnt.security.allow-unfixed-cve`	`true`, `false`	When `false`, blocks images with CVEs even if no vendor fix/patch is currently available.
`gbnt.security.signer`	`string`	Restricts admission to images signed by a specific signer identity or organization.

5. Google SRE SLO Engine Labels (`gbnt.slo.*`)

Gubernator integrates the Sloth SLO Engine to automatically translate service labels into Prometheus recording rules and multi-window burn-rate alerts:

version: '3.8'

services:
  api:
    image: my-service:latest
    labels:
      gbnt.slo.enable: "true"
      gbnt.slo.target: "99.9"
      gbnt.slo.window: "30d"
      gbnt.slo.indicator: "latency"
      gbnt.slo.latency.threshold: "200ms"

Label	Description	Example
`gbnt.slo.enable`	Activates SLO tracking for this service	`true`
`gbnt.slo.target`	Target availability objective %	`99.9` (Three Nines), `99.99`
`gbnt.slo.window`	Rolling error budget evaluation window	`30d`, `7d`, `90d`
`gbnt.slo.indicator`	Type of Service Level Indicator	`availability` (HTTP 5xx error rate) or `latency`
`gbnt.slo.latency.threshold`	Maximum latency objective	`200ms`, `500ms`, `1s`

6. Granaries & Persistent Shared Storage (`/var/contenedores/`)

For persistent data mobility across Centurion nodes, mount host directories under /var/contenedores/:

version: '3.8'

services:
  database:
    image: postgres:16-alpine
    volumes:
      - /var/contenedores/${STACK_NAME}/pgdata:/var/lib/postgresql/data

7. Supported Compose Fields

Gubernator's parser focuses on the fields necessary for container scheduling, security admission, and networking:

image: The container image to pull, verify signatures, and run.
labels: Service-level metadata for Ingress routing, Security Gatekeeper, and Sloth SLOs.
ports: Ports to expose (also used for Ingress target detection).
environment: Environment variables (supports both map and array formats).
volumes: Local, shared /var/contenedores/, and named volume mounts.
command: Overrides the default container command.
depends_on: Ensures proper startup ordering of services.
deploy.replicas: Number of container instances to spawn.
deploy.placement.constraints: Node hardware affinity (e.g. gbnt.node.gpu == nvidia, node.role == worker) and stack constraints.

8. Loading Stacks from Master Server Filesystem & Workstations

Gubernator supports flexible stack loading from both your client browser/workstation and the Master server filesystem:

Deployment Methods

Method	Source	UI Action	CLI Command
Client Workstation	Local PC disk	Click "My PC" in Stacks / Studio	`gbnt stack deploy my-stack -f ./local-compose.yml`
Master Server Filesystem	Manager host disk	Click "Master Server" in Stacks / Studio	`gbnt stack deploy my-stack -s ~/.gbnt/stacks/app.yml`
Built-in POC Blueprints	In-cluster embedded library	Click "POC Blueprints" in Stacks / Studio	`gbnt examples deploy <id>`

Server Directory Structure

When Gubernator starts, it automatically ensures and indexes the following directories on the Master host:

~/.gbnt/stacks/: User-defined Docker Compose stacks. Drop .yml or .yaml files here to manage them directly on the server.
~/.gbnt/examples/: Bundled production POC example blueprints exported for inspection and modification.
/etc/gubernator/stacks/: System-wide shared stacks directory.

Listing Server Stack Files

To inspect stack files available on the Master host:

# List files in default directories (~/.gbnt/stacks and ~/.gbnt/examples)
gbnt stack server-ls

# List files in a custom directory on the Master host
gbnt stack server-ls --dir /opt/docker-stacks

9. Built-in POC Examples Library & Bootstrap Auto-Deployment

Gubernator includes an embedded catalog of 8 production-grade proof-of-concept (POC) blueprints designed to demonstrate clustering, service discovery, persistent storage, security, and observability out of the box:

hello-loadbalancer: High-availability web app with 2 replicas, Caddy load balancing, and CoreDNS discovery.
wordpress-mysql: WordPress CMS with MySQL 8.0 backend and persistent storage mounts.
public-https: Automatic Let's Encrypt / ZeroSSL public TLS reverse proxy via Caddy.
sloth-slo: Microservice with Google SRE Sloth SLO labels and multi-window burn-rate alert rules.
n8n-workflow: Self-hosted workflow automation platform with PostgreSQL persistence.
jaeger-tracing: Distributed tracing service with OpenTelemetry export and Jaeger UI.
jupyter-datascience: Interactive Python data science notebook workspace.
sre-observability: Microservice exporting Prometheus metrics for full observability validation.

Deploying POC Examples During Installation

To deploy all POC examples automatically when initializing a new cluster:

# Option A: Deploy during cluster initialization
gbnt legion init --with-examples

# Option B: Environment variable flag on manager startup
export GBNT_DEPLOY_EXAMPLES=true
gbnt serve

On-Demand POC Deployment via CLI

# List all available POC blueprints
gbnt examples ls

# Deploy a specific POC blueprint
gbnt examples deploy hello-loadbalancer

# Deploy all POC blueprints into the cluster
gbnt examples deploy all

10. Declarative Horizontal Autoscaling & GPU/CPU Affinity

Gubernator natively evaluates declarative autoscaling directives configured directly inside your docker-compose.yml service labels (gbnt.autoscaling.*):

services:
  inference:
    image: vllm/vllm-openai:latest
    labels:
      - "gbnt.autoscaling.enable=true"
      - "gbnt.autoscaling.metric=gpu"
      - "gbnt.autoscaling.scope=cluster"
      - "gbnt.autoscaling.target=80"
      - "gbnt.autoscaling.min=1"
      - "gbnt.autoscaling.max=4"
      - "gbnt.autoscaling.cooldown=60s"
      - "gbnt.placement.strategy=spread"
    deploy:
      replicas: 1
      placement:
        constraints:
          - "gbnt.node.gpu == nvidia"

Supported Autoscaling Labels

Label	Default	Description
`gbnt.autoscaling.enable`	`false`	Enable or disable horizontal autoscaling.
`gbnt.autoscaling.metric`	`cpu`	Metric monitored: `gpu` (NVIDIA DCGM/Prometheus) or `cpu`.
`gbnt.autoscaling.scope`	`host`	`host` (scale on local node) or `cluster` (distribute across nodes).
`gbnt.autoscaling.target`	`80`	Target utilization percentage threshold.
`gbnt.autoscaling.min`	`1`	Minimum replica floor.
`gbnt.autoscaling.max`	`5`	Maximum replica ceiling.
`gbnt.autoscaling.cooldown`	`60s`	Minimum cooldown between scaling events.

Single-Host vs. Multi-Host Placement Interaction

Single-Host Containment: If gbnt.placement.strategy: single-host or a pinned node constraint (node.hostname == ...) is specified, the autoscaler automatically confines scaling to that single host, overriding any cluster-wide requests to maintain atomic stack placement.
GPU Hardware Affinity: When metric: gpu is configured in cluster mode, the scheduler strictly targets nodes with verified NVIDIA GPU hardware, excluding CPU-only Centurions from horizontal scale-out.

11. Multi-Host Placement, Anti-Affinity & Hardware Affinity

Gubernator supports both atomic stack placement and distributed multi-host scheduling across Centurion nodes.

A. Replica Anti-Affinity (Spread Strategy)

To spread service replicas across different physical nodes (e.g. 3 replicas on 3 different hosts), configure either Compose placement preferences or Gubernator labels:

services:
  web:
    image: nginx:alpine
    ports:
      - "8080:80"
    labels:
      - "ingress.host=web.gbnt.local"
      - "gbnt.caddy.port=8080"
      - "gbnt.placement.strategy=spread"
    deploy:
      replicas: 3
      placement:
        preferences:
          - spread: node.id
        constraints:
          - "node.role == worker"

spread: node.id: Distributes each replica to a distinct Centurion node.
Least-Loaded Fallback: If the cluster has fewer worker nodes than the desired number of replicas, Gubernator spreads replicas across all available nodes and places extra instances on the least-loaded node.

B. Hardware & Role Affinity Constraints

Use deploy.placement.constraints to pin workloads to specific nodes:

services:
  ai-inference:
    image: vllm/vllm-openai:latest
    deploy:
      placement:
        constraints:
          # Pin strictly to Centurions with verified NVIDIA GPUs:
          - "gbnt.node.gpu == nvidia"
          # Or pin to worker nodes:
          - "node.role == worker"
          # Or pin to a specific hostname:
          - "node.hostname == gbnt-worker-1"

(See Multi-Host Placement Documentation for architecture diagrams and scheduling details).

12. Dynamic Caddy Load Balancing & Health Checks

When services run multiple replicas across cluster nodes, Gubernator dynamically configures Caddy Ingress reverse proxying with multi-upstream load balancing and active HTTP health probing:

services:
  api:
    image: python:3.11-alpine
    ports:
      - "8080:8080"
    labels:
      - "ingress.host=api.gbnt.local"
      - "gbnt.caddy.port=8080"
      # Load balancing policy:
      - "gbnt.caddy.lb=round_robin"
      # Active health check URI:
      - "gbnt.caddy.health_uri=/health"
      - "gbnt.caddy.health_interval=5s"
      - "gbnt.caddy.health_timeout=2s"
      # Web Application Firewall (Coraza):
      - "gbnt.waf.enabled=true"
      - "gbnt.waf.mode=enforce"

Supported Ingress & Load Balancing Labels

Label / Constraint	Values	Default	Description
`ingress.host` / `gbnt.ingress.host`	FQDN domain	None	Domain routed to this service (e.g. `api.gbnt.local` or `demo.fiware.app`).
`gbnt.caddy.port`	Port number	Auto	Explicit container port for Caddy proxying (overrides auto-detection from `ports:`).
`gbnt.caddy.lb` / `ingress.lb`	`round_robin`, `least_conn`, `ip_hash`, `first`, `random`	`round_robin`	Upstream load balancing algorithm across replica nodes.
`gbnt.caddy.health_uri`	Path (e.g. `/health`, `/healthz`)	None	Active health probe URI. Automatically evicts unhealthy upstreams.
`gbnt.caddy.health_interval`	Duration (e.g. `5s`, `10s`)	`5s`	Interval between active health check probes.
`gbnt.caddy.health_timeout`	Duration (e.g. `2s`, `5s`)	`2s`	Probe timeout before marking upstream node down.
`gbnt.caddy.tls`	`internal`, `off`	Auto	Force internal self-signed TLS (`internal`) or disable TLS (`off`).
`gbnt.waf.enabled`	`true`, `false`	`false`	Activates Coraza Web Application Firewall (OWASP CRS).
`gbnt.waf.mode`	`enforce`, `detection`	`enforce`	Blocks malicious payloads (`enforce`) or logs them (`detection`).

(See Caddy Ingress Documentation for TLS certificate lifecycle and CA trust installation).

13. CoreDNS Internal Service Discovery

Gubernator integrates an embedded CoreDNS nameserver across the cluster. Every container deployed by Gubernator can resolve internal services via short or fully-qualified DNS names:

services:
  database:
    image: postgres:16-alpine
    hostname: postgres
    environment:
      POSTGRES_DB: appdb

  backend:
    image: my-backend:latest
    dns:
      - "127.0.0.1"
      - "172.17.0.1"
    environment:
      # Resolves dynamically to the postgres container IP on the cluster:
      DB_HOST: postgres.{{stack.name}}.gbnt

DNS Forwarding: Unresolved external queries (e.g. google.com, github.com) are automatically forwarded to upstream DNS servers (8.8.8.8, 1.1.1.1).
Format: <service>.<stack>.gbnt resolves to the container's virtual IP.

(See CoreDNS Documentation for DNS zone records and architecture).

14. CPU & RAM Resource Limits

To safeguard cluster stability, define hard limits and soft reservations using standard deploy.resources:

services:
  web:
    image: nginx:alpine
    deploy:
      resources:
        limits:
          cpus: "1.0"
          memory: 512M
        reservations:
          cpus: "0.25"
          memory: 128M

limits: Hard cgroup ceiling. If memory exceeds 512M, the container is OOM-killed. If CPU exceeds 1.0, throttling is applied.
reservations: Minimum guaranteed capacity reserved by the scheduler on the host.

15. Container Healthchecks & Restart Policies

services:
  api:
    image: python:3.11-alpine
    restart: unless-stopped
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:8080/health || exit 1"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 5s

restart: unless-stopped: Automatically restarts the container if it crashes or the Centurion host reboots.
healthcheck: Docker Engine periodically probes the container. The Gubernator dashboard displays health status chips (healthy, unhealthy, starting).

16. Gubernator Compose Studio (Web IDE & Copilot)

The Gubernator Web Dashboard features a dedicated Compose Studio (/#/studio) designed for effortless authoring with zero memorization of syntax or labels:

Core Studio Capabilities

Target Service Header: Shows which service is currently targeted with live line range indicators ([✓ ACTIVO • L14]).
10 Visual Copilot Tabs:
Docker: Ports, volumes, restart policy, environment, healthchecks.
Resources: One-click presets (Micro, Standard, High-Load, Custom).
Autoscale: CPU & GPU autoscaling toggles with scope and cooldowns.
Caddy: Ingress routing, load balancing algorithms, health check probes.
CoreDNS: Cluster DNS injection and internal domain resolution.
SLO: Sloth Google SRE multi-burn-rate error budget templates.
Security & WAF: Cosign cryptographic signing, CVE thresholds, WAF Coraza.
Placement & LB: Worker/Manager affinity, GPU affinity, Spread anti-affinity.
Storage: Shared /var/contenedores/ pool mounts, named volumes.
Templates: Production POC blueprints ready for instant deployment.
Decoupled One-Click Actions:
Green Check / Add: Injects or toggles configuration cleanly.
Red Trash Button: Safely removes the target configuration without touching any surrounding YAML headers or service blocks.
Soft Gutter & Syntax Styling: JetBrains Mono typography, soft line numbers, and clean dark/light themes.

17. Master Reference Cheat Sheet: All Labels & Directives

Category	Label / Directive	Valid Values	Default	Purpose
Stack Naming	`deploy.placement.constraints: stack.name == <name>`	String	First service / auto	Sets the unique stack identifier.
Stack Naming	`name: <name>`	String	Directory name	Native Compose stack name attribute.
Ingress	`ingress.host: <domain>`	Hostname / FQDN	None	Domain routing (local internal TLS or public Let's Encrypt).
Ingress	`ingress.email: <email>`	Email string	None	Contact email for Let's Encrypt ACME notifications.
Ingress	`ingress.tls: <mode>`	`internal`, `off`	Auto	Force self-signed root CA or disable TLS.
Caddy LB	`gbnt.caddy.port: <port>`	Integer port	Auto from `ports:`	Target upstream container port for proxying.
Caddy LB	`gbnt.caddy.lb: <algo>`	`round_robin`, `least_conn`, `ip_hash`	`round_robin`	Upstream load balancing policy across replicas.
Caddy Health	`gbnt.caddy.health_uri: <path>`	`/health`, `/healthz`, `/`	None	Active HTTP probe path for upstream eviction.
Caddy Health	`gbnt.caddy.health_interval: <dur>`	`2s`, `5s`, `10s`	`5s`	Interval between active health check probes.
Caddy Health	`gbnt.caddy.health_timeout: <dur>`	`1s`, `2s`, `5s`	`2s`	Active probe timeout before marking node down.
WAF	`gbnt.waf.enabled: <bool>`	`true`, `false`	`false`	Coraza Web Application Firewall protection.
WAF	`gbnt.waf.mode: <mode>`	`enforce`, `detection`	`enforce`	Action mode for detected web attack vectors.
Placement	`gbnt.placement.strategy: <strat>`	`spread`, `single-host`	`spread`	Multi-host spread vs single-node atomic placement.
Placement	`deploy.placement.preferences: spread: node.id`	N/A	None	Distributes replicas across distinct Centurion hosts.
Placement	`deploy.placement.constraints: node.role == worker`	`worker`, `manager`	None	Restricts container execution to specific node roles.
Hardware	`deploy.placement.constraints: gbnt.node.gpu == nvidia`	`nvidia`	None	Restricts container scheduling to GPU-equipped Centurions.
Hardware	`deploy.placement.constraints: node.hostname == <host>`	Node hostname	None	Pins container to an exact physical Centurion host.
Autoscale	`gbnt.autoscaling.enable: <bool>`	`true`, `false`	`false`	Enables declarative horizontal autoscaling.
Autoscale	`gbnt.autoscaling.metric: <type>`	`cpu`, `gpu`	`cpu`	Utilization metric monitored for scaling decisions.
Autoscale	`gbnt.autoscaling.scope: <scope>`	`cluster`, `host`	`host`	Scale across multiple Centurions or on the local node.
Autoscale	`gbnt.autoscaling.target: <pct>`	Integer `1` to `100`	`80`	Target utilization percentage threshold.
Autoscale	`gbnt.autoscaling.min: <num>`	Integer `>= 1`	`1`	Minimum replica floor during low traffic.
Autoscale	`gbnt.autoscaling.max: <num>`	Integer `>= 1`	`5`	Maximum replica ceiling during high traffic.
Autoscale	`gbnt.autoscaling.cooldown: <dur>`	`30s`, `45s`, `60s`	`60s`	Evaluation cooldown between scaling operations.
Security	`gbnt.security.require-signature: <bool>`	`true`, `false`	`false`	Admission policy requiring valid Cosign digital signature.
Security	`gbnt.security.max-cve-severity: <sev>`	`critical`, `high`, `medium`, `none`	`none`	Maximum tolerated CVE vulnerability severity.
Security	`gbnt.security.allow-unfixed-cve: <bool>`	`true`, `false`	`true`	Allows or blocks images with CVEs having no vendor patch.
Security	`gbnt.security.signer: <identity>`	Key identity string	None	Restricts admission to images signed by a specific entity.
Sloth SLO	`gbnt.slo.enable: <bool>`	`true`, `false`	`false`	Enables Google SRE Sloth SLO tracking & error budgets.
Sloth SLO	`gbnt.slo.target: <pct>`	`99.0`, `99.9`, `99.99`	`99.9`	Target availability objective percentage.
Sloth SLO	`gbnt.slo.window: <window>`	`30d`, `7d`, `90d`	`30d`	Rolling error budget evaluation window.
Sloth SLO	`gbnt.slo.indicator: <ind>`	`availability`, `latency`	`availability`	Service Level Indicator metric type.
Sloth SLO	`gbnt.slo.latency.threshold: <lat>`	`200ms`, `500ms`, `1s`	`200ms`	Latency objective threshold.
Storage	`volumes: - /var/contenedores/...`	Host directory mount	None	Persistent mobility mount root across Centurion nodes.
Resources	`deploy.resources.limits.cpus: "<num>"`	Float string (e.g. `"1.0"`)	None	Hard CPU core limit.
Resources	`deploy.resources.limits.memory: <size>`	Size string (e.g. `512M`)	None	Hard RAM memory ceiling (OOM limit).
Resources	`deploy.resources.reservations.cpus: "<num>"`	Float string (e.g. `"0.25"`)	None	Soft guaranteed CPU reservation for scheduler.
Resources	`deploy.resources.reservations.memory: <size>`	Size string (e.g. `128M`)	None	Soft guaranteed RAM reservation for scheduler.
DNS	`dns: ["127.0.0.1", "172.17.0.1"]`	IP list	Host DNS	Injects cluster CoreDNS nameserver into container.
Restart	`restart: unless-stopped`	`always`, `unless-stopped`, `on-failure`, `no`	`no`	Container process lifecycle restart behavior.
Health	`healthcheck.test: ["CMD-SHELL", "..."]`	Command array	None	In-container health verification probe.