# High-trust opt-in for host bind-mount ownership/mode repair.
# Dockwatch can chown host files through /host, so use only on trusted machines.
services:
  dockwatch:
    environment:
      HOST_ROOT: /host
      ALLOW_HOST_USER_MANAGEMENT: "true"
      ALLOW_HOST_PERMISSION_MANAGEMENT: "true"
    volumes:
      - /:/host:rw