mirror of
https://github.com/andreicscs/HoneyWire
synced 2026-06-26 12:39:53 +00:00
andreicscs
41 lines
1.1 KiB
YAML
41 lines
1.1 KiB
YAML
services:
|
|
# 1. THE FIXER: Runs as root, fixes permissions, and dies instantly.
|
|
permission-fixer:
|
|
image: alpine:latest
|
|
# 65532 is the standard UID/GID for the Distroless nonroot user
|
|
command: sh -c "chown -R 65532:65532 /data"
|
|
volumes:
|
|
- ./honeywire_data:/data
|
|
|
|
# 2. THE HUB: Pure Go distroless backend and UI.
|
|
honeywire-hub:
|
|
image: ghcr.io/andreicscs/honeywire-hub:latest
|
|
container_name: honeywire-hub
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
restart: unless-stopped
|
|
|
|
ports:
|
|
- "${HW_PORT:-8080}:${HW_PORT:-8080}"
|
|
|
|
# --- SECURITY SANDBOX ---
|
|
user: "65532:65532"
|
|
read_only: true
|
|
cap_drop: ["ALL"]
|
|
security_opt: ["no-new-privileges:true"]
|
|
# ------------------------
|
|
|
|
volumes:
|
|
# The database volume remains writable, while the container OS is read-only
|
|
- ./honeywire_data:/data
|
|
|
|
depends_on:
|
|
# This ensures the Hub waits until the fixer is completely finished
|
|
permission-fixer:
|
|
condition: service_completed_successfully
|
|
|
|
environment:
|
|
- HW_PORT=8080
|
|
- HW_DB_PATH=/data/honeywire.db
|