services:
  dockwatch-agent:
    image: dockwatch:local
    restart: unless-stopped
    ports: ["127.0.0.1:8080:8080"]
    environment:
      APP_MODE: agent
      AGENT_TOKEN: "replace-with-a-random-token-at-least-24-characters"
      HTTP_TIMEOUT_SECONDS: "10"
      # Optional: set HOST_ROOT=/host and mount /:/host:ro for identity checks.
      HOST_ROOT: ""
      ALLOW_HOST_USER_MANAGEMENT: "false"
      ALLOW_HOST_PERMISSION_MANAGEMENT: "false"
      HOST_SECURITY_ENABLED: "false"
      ALLOW_HOST_SECURITY_CHANGES: "false"
      ALLOW_HOST_PACKAGE_MANAGEMENT: "false"
      HOST_SECURITY_HOST_PID: "1"
    volumes:
      - ./agent-data:/data
      - ./agent-stacks:/stacks
      - /var/run/docker.sock:/var/run/docker.sock
      # For read-only host UID/GID + bind ownership checks:
      # - /:/host:ro
      # For explicit admin host-user creation only: use /:/host:rw and set
      # ALLOW_HOST_USER_MANAGEMENT=true.