# READ-ONLY HOST SECURITY AUDIT
#
# This mode can inspect installed host configuration and files but cannot
# change packages or configuration. Active service state is reported only when
# the optional host namespace executor is available.
services:
  dockwatch:
    environment:
      HOST_ROOT: /host
      HOST_SECURITY_ENABLED: "true"
      ALLOW_HOST_SECURITY_CHANGES: "false"
      ALLOW_HOST_PACKAGE_MANAGEMENT: "false"
      HOST_AUR_USER: ""
    volumes:
      - /:/host:ro