# FULL HOST SECURITY MANAGEMENT (HIGH PRIVILEGE)
#
# This override intentionally grants Dockwatch broad host capabilities so it
# can install packages, enter the host namespaces, manage services, nftables,
# Fail2Ban and auditd. Use only on hosts where Dockwatch is part of your trusted
# administration plane. Keep OIDC enabled and restrict admin membership.
services:
  dockwatch:
    pid: host
    privileged: true
    environment:
      HOST_ROOT: /host
      HOST_SECURITY_ENABLED: "true"
      ALLOW_HOST_SECURITY_CHANGES: "true"
      ALLOW_HOST_PACKAGE_MANAGEMENT: "true"
      # Arch only: set to the non-root user that owns paru/yay configuration/cache.
      HOST_AUR_USER: ""
      HOST_SECURITY_HOST_PID: "1"
    volumes:
      - /:/host:rw