Unfortunately, docker-compose does not have any way, on how to limit cpus during build. While it's possible for deploy. The only way to do it in your case, is to build image manually with specified limitation.

docker build -t someimagename --cpuset-cpus 0 .

and then just add this image name to docker-compose.yml, you can keep the build section, it will not be used if you desired image already produced.

services:
  iris:
    image: someimagename
    cpuset: "0-7"
$ docker run --init --name my-iris -it --rm -p 9091:1972 -p 9092:52772 -p 9093:52773 -p 9094:7041 store/intersystems/iris-community-arm64:2020.4.0.524.0                                                                              

[INFO] Starting InterSystems IRIS instance IRIS...
[INFO] This copy of InterSystems IRIS has been licensed for use exclusively by:
InterSystems IRIS Community
Copyright (c) 1986-2020 by InterSystems Corporation
Any other use is a violation of your license agreement
Starting IRIS 

Sign-on inhibited.
See messages.log for details. 

[ERROR] Unknown QEMU_IFLA_INFO_KIND ipip
Unknown QEMU_IFLA_INFO_KIND ip6tnl
qemu: uncaught target signal 6 (Aborted) - core dumped
11/26/20-10:05:11:295 (954) 0 [Generic.Event] Global buffer setting requires attention.  Auto-selected 25% of total memory.
11/26/20-10:05:11:508 (954) 0 [Generic.Event] Allocated 1557MB shared memory: 1234MB global buffers, 123MB routine buffers
11/26/20-10:05:12:118 (954) 0 [WriteDaemon.UsingWIJFile] Using WIJ file: /usr/irissys/mgr/IRIS.WIJ
11/26/20-10:05:12:119 (954) 0 [WriteDaemon.CreatingNewWIJ] Creating a new WIJ file
11/26/20-10:05:13:081 (954) 0 [WriteDaemon.CreatedNewWIJ] New WIJ file created
11/26/20-10:05:13:205 (957) 0 [WriteDaemon.Started] Write daemon started.
11/26/20-10:05:13:206 (957) 2 [Generic.Event] create_iotd_pool failed because LKIO_SETUP returned error 38
11/26/20-10:05:13:222 (964) 2 [Generic.Event] create_iotd_pool failed because LKIO_SETUP returned error 38
11/26/20-10:05:13:222 (963) 2 [Generic.Event] create_iotd_pool failed because LKIO_SETUP returned error 38
11/26/20-10:05:13:224 (957) 2 [Generic.Event] create_iotd_pool failed because LKIO_SETUP returned error 38...(repeated 63 times)
11/26/20-10:05:13:224 (957) 1 [Generic.Event] Write daemon asynchronous I/O disabled dueto failure allocating control structures.
11/26/20-10:05:13:228 (964) 2 [Generic.Event] create_iotd_pool failed because LKIO_SETUP returned error 38...(repeated 63 times)
11/26/20-10:05:13:228 (964) 1 [Generic.Event] Write daemon asynchronous I/O disabled dueto failure allocating control structures.
11/26/20-10:05:13:228 (963) 2 [Generic.Event] create_iotd_pool failed because LKIO_SETUP returned error 38...(repeated 63 times)
11/26/20-10:05:13:228 (963) 1 [Generic.Event] Write daemon asynchronous I/O disabled dueto failure allocating control structures.
11/26/20-10:05:15:881 (954) 0 [Generic.Event]
Startup of InterSystems IRIS [IRIS for UNIX (Ubuntu Server LTS for ARM64 Containers) 2020.4 (Build 524U) Thu Oct 22 2020 16:49:47 UTC]
    in ./
    with mgr: /usr/irissys/mgr
    with wij: /usr/irissys/mgr/IRIS.WIJ
    from: /usr/irissys/mgr/
  OS=[Linux], version=[#1 SMP Fri May 8 23:03:06 UTC 2020], release=[5.4.39-linuxkit], machine=[aarch64]
  nodename=[dbac38c4a18e].
  numasyncwijbuf: 0, swdwrtmax: 0, wijdirectio: on, synctype: 3
  System Initialized.
11/26/20-10:05:17:582 (979) 0 [Database.MountedRW] Mounted database /usr/irissys/mgr/ (SFN 0) read-write.
11/26/20-10:05:18:285 (979) 3 [Generic.Event] Process 979 (JobType=Interactive job (application mode),Dumpstyle=0,Directory='/usr/irissys/mgr/') caught signal 11.
11/26/20-10:05:18:793 (979) 3 [Generic.Event] If core dumps are enabled, a core file will be created by process 982 in the location specified by the system configuration.
11/26/20-10:05:18:802 (979) 3 [Generic.Event] Parent process will clean up and halt
[ERROR] See /usr/irissys/mgr/messages.log for more information
[FATAL] Error starting InterSystems IRIS

Could you provide what error you got?

I've tried to run it with Qemu, on GitHub Actions, or locally on macOS (Docker on macOS supports running ARM64 images as well)

I don't have RPi, yet. Did not manage to play with it, but at least I've managed to run it on AWS EC2 ARM64 instance.

My messages.log when failed was looked like this.

Dmitry Maslennikov, [16.11.20 13:29]
11/16/20-09:09:14:181 (957) 0 [Generic.Event] Global buffer setting requires attention.  Auto-selected 25% of total memory.
11/16/20-09:09:14:302 (957) 0 [Generic.Event] Allocated 1557MB shared memory: 1234MB global buffers, 123MB routine buffers
11/16/20-09:09:14:396 (957) 0 [WriteDaemon.UsingWIJFile] Using WIJ file: /usr/irissys/mgr/IRIS.WIJ
11/16/20-09:09:14:398 (957) 0 [WriteDaemon.CreatingNewWIJ] Creating a new WIJ file
11/16/20-09:09:14:862 (957) 0 [WriteDaemon.CreatedNewWIJ] New WIJ file created
11/16/20-09:09:14:897 (957) 0 [Generic.Event] 
Startup of InterSystems IRIS [IRIS for UNIX (Ubuntu Server LTS for ARM64 Containers) 2020.4 (Build 524U) Thu Oct 22 2020 16:49:47 UTC]
       in ./
       with mgr: /usr/irissys/mgr
       with wij: /usr/irissys/mgr/IRIS.WIJ
       from: /usr/irissys/mgr/
  OS=[Linux], version=[#1 SMP Fri May 8 23:03:06 UTC 2020], release=[5.4.39-linuxkit], machine=[aarch64]
  nodename=[buildkitsandbox].
  numasyncwijbuf: 8, swdwrtmax: 64, wijdirectio: on, synctype: 3
  System Initialized.
11/16/20-09:09:14:933 (972) 2 [Generic.Event] create_iotd_pool failed because LKIO_SETUP returned error 38
11/16/20-09:09:14:936 (966) 2 [Generic.Event] create_iotd_pool failed because LKIO_SETUP returned error 38
11/16/20-09:09:14:937 (972) 2 [Generic.Event] create_iotd_pool failed because LKIO_SETUP returned error 38...(repeated 63 times)
11/16/20-09:09:14:937 (972) 1 [Generic.Event] Write daemon asynchronous I/O disabled dueto failure allocating control structures.
11/16/20-09:09:14:940 (966) 2 [Generic.Event] create_iotd_pool failed because LKIO_SETUP returned error 38...(repeated 63 times)
11/16/20-09:09:14:940 (966) 1 [Generic.Event] Write daemon asynchronous I/O disabled dueto failure allocating control structures.
11/16/20-09:09:14:947 (960) 0 [WriteDaemon.Started] Write daemon started.
11/16/20-09:09:14:948 (960) 2 [Generic.Event] create_iotd_pool failed because LKIO_SETUP returned error 38
11/16/20-09:09:14:949 (960) 2 [Generic.Event] create_iotd_pool failed because LKIO_SETUP returned error 38...(repeated 7 times)
11/16/20-09:09:14:949 (960) 1 [Generic.Event] Write daemon asynchronous I/O disabled dueto failure allocating control structures.
11/16/20-09:09:15:354 (982) 0 [Database.MountedRW] Mounted database /usr/irissys/mgr/ (SFN 0) read-write.
11/16/20-09:09:15:397 (982) 3 [Generic.Event] Process 982 (JobType=Interactive job (application mode),Dumpstyle=0,Directory='/usr/irissys/mgr/') caught signal 11. 
11/16/20-09:09:15:404 (982) 3 [Generic.Event] Parent process will clean up and halt
11/16/20-09:09:15:405 (982) 3 [Generic.Event] If core dumps are enabled, a core file will be created by process 985 in the location specified by the system configuration.

The applications you mentioned, it's not exactly applications, it's just kind of entrypoint to the application.

Security in Caché and in IRIS now, was not so good in my opinion, for many reasons.

An application developer, if he would like to use role-based security is too limited to use the Security model from InterSystems.

And no matter how many different applications customers would like to use on their own Instance of IRIS, security will be global.

Issues with mirroring, with ECP, any instance of IRIS use own tables, and have to be synchronized in some ways. Such big clusters should have the ability to use the same security settings on any instance, out of the box.

Application, real, not virtual, should have the ability to re-use Security and store it close to Application's data.