services:
  npm:
    mem_limit: 160m
    # Public ingress — elevated OOM protection so TLS termination + proxy host
    # config survive memory pressure. Host OOM-killer will not target this container.
    oom_score_adj: -800