diff --git a/Caddyfile b/Caddyfile
index dca5654051..36b6225e0e 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -6,7 +6,7 @@
 http://{$BASE_URL} {
         bind {$ADDRESS}
         reverse_proxy /ws/* http://lsp:3001
-        reverse_proxy /* http://windmill:8000
+        reverse_proxy /* http://windmill_server:8000
 }
 
 https://{$BASE_URL}  {  
diff --git a/docker-compose.yml b/docker-compose.yml
index 2aa46a088b..865f6eb7b4 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -20,29 +20,41 @@ services:
       timeout: 5s
       retries: 5
 
-  windmill:
+  windmill_server:
     image: ghcr.io/windmill-labs/windmill:main
-    # Set privileged to true if enabling nsjail
-    privileged: false
+    deploy:
+      replicas: 1
     restart: unless-stopped
     ports:
       - 8000:8000
+    environment:
+      - DATABASE_URL=postgres://postgres:${DB_PASSWORD}@db/windmill?sslmode=disable
+      - BASE_URL=http://${WM_BASE_URL}
+      - RUST_LOG=info
+      ## You can set the number of workers to > 0 and not need any separate worker service
+      - NUM_WORKERS=0
+      - DISABLE_SERVER=false
+      - METRICS_ADDR=false
+    depends_on:
+      db:
+        condition: service_healthy
+
+  windmill_worker:
+    image: ghcr.io/windmill-labs/windmill:main
+    deploy:
+      replicas: 3
+    restart: unless-stopped
     environment:
       - DATABASE_URL=postgres://postgres:${DB_PASSWORD}@db/windmill?sslmode=disable
       - BASE_URL=http://${WM_BASE_URL}
       - BASE_INTERNAL_URL=http://localhost:8000
       - RUST_LOG=info
-      - NUM_WORKERS=3
+      - NUM_WORKERS=1
+      - DISABLE_SERVER=true
       - KEEP_JOB_DIR=false
       - DENO_PATH=/usr/bin/deno
       - PYTHON_PATH=/usr/local/bin/python3
       - METRICS_ADDR=false
-      # for ease of use, nsjail which provide isolation in untrusted environment is disabled by default. 
-      # To enable it, uncomment the following line, set the container as privileged and
-      # rebuild the image with nsjail=true or use the enterprise edition
-      # - DISABLE_NSJAIL=false
-      # - DISABLE_NUSER=false
-      # - NSJAIL_PATH=nsjail
     depends_on:
       db:
         condition: service_healthy