14 lines
552 B
YAML
14 lines
552 B
YAML
# DANGEROUS / EXPLICIT OPT-IN:
|
|
# This gives Dockwatch write access to the host root so an administrator can create
|
|
# a local user/group matching a container's effective UID/GID. The Docker socket
|
|
# already grants broad host control, but this mount increases direct filesystem
|
|
# exposure. Use only on trusted hosts and keep ALLOW_HOST_USER_MANAGEMENT=false by default.
|
|
services:
|
|
dockwatch:
|
|
environment:
|
|
HOST_ROOT: /host
|
|
ALLOW_HOST_USER_MANAGEMENT: "true"
|
|
ALLOW_HOST_PERMISSION_MANAGEMENT: "false"
|
|
volumes:
|
|
- /:/host:rw
|