21 lines
754 B
YAML
21 lines
754 B
YAML
# FULL HOST SECURITY MANAGEMENT (HIGH PRIVILEGE)
|
|
#
|
|
# This override intentionally grants Dockwatch broad host capabilities so it
|
|
# can install packages, enter the host namespaces, manage services, nftables,
|
|
# Fail2Ban and auditd. Use only on hosts where Dockwatch is part of your trusted
|
|
# administration plane. Keep OIDC enabled and restrict admin membership.
|
|
services:
|
|
dockwatch:
|
|
pid: host
|
|
privileged: true
|
|
environment:
|
|
HOST_ROOT: /host
|
|
HOST_SECURITY_ENABLED: "true"
|
|
ALLOW_HOST_SECURITY_CHANGES: "true"
|
|
ALLOW_HOST_PACKAGE_MANAGEMENT: "true"
|
|
# Arch only: set to the non-root user that owns paru/yay configuration/cache.
|
|
HOST_AUR_USER: ""
|
|
HOST_SECURITY_HOST_PID: "1"
|
|
volumes:
|
|
- /:/host:rw
|