services:
  service-controller:
    image: ${NEURALHUNT_SERVICE_CONTROLLER_IMAGE:-neuralhunt-service-controller:local}
    build:
      context: .
      dockerfile: Dockerfile.service-controller
    env_file:
      - path: .env.controller
        required: true
    # Linux worker host: the controller is reachable directly on the host/VPN
    # addresses configured in SC_ADVERTISE_URL. Keep 8101/8102 firewalled to the
    # private management network/VPN only.
    network_mode: host
    user: "0:0"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    restart: unless-stopped