# DANGEROUS / EXPLICIT OPT-IN:
# This gives Dockwatch write access to the host root so an administrator can create
# a local user/group matching a container's effective UID/GID. The Docker socket
# already grants broad host control, but this mount increases direct filesystem
# exposure. Use only on trusted hosts and keep ALLOW_HOST_USER_MANAGEMENT=false by default.
services:
  dockwatch:
    environment:
      HOST_ROOT: /host
      ALLOW_HOST_USER_MANAGEMENT: "true"
      ALLOW_HOST_PERMISSION_MANAGEMENT: "false"
    volumes:
      - /:/host:rw