services:
  # Docker Socket Proxy - Security Enchanced Proxy for Docker Socket
  socket-proxy:
    image: lscr.io/linuxserver/socket-proxy:latest
    container_name: socket-proxy
    security_opt:
      - no-new-privileges:true
    restart: unless-stopped
    profiles: ["core", "all"]
    networks:
      socket_proxy:
        ipv4_address: 192.168.91.254 # You can specify a static IP
    # privileged: true # true for VM. False (default) for unprivileged LXC container.
    # ports:
      #- "2375:2375"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
    read_only: true
    tmpfs:
      - /run
    environment:
      - LOG_LEVEL=warning # debug,info,notice,warning,err,crit,alert,emerg
      - ALLOW_START=1 # Portainer
      - ALLOW_STOP=1 # Portainer
      - ALLOW_RESTARTS=1 # Portainer
      ## Granted by Default
      - EVENTS=1
      - PING=1
      - VERSION=1
      ## Revoked by Default
      # Security critical
      - AUTH=0
      - SECRETS=0
      - POST=1 # Watchtower
      # Not always needed
      - BUILD=0
      - COMMIT=0
      - CONFIGS=0
      - CONTAINERS=1 # Traefik, portainer, etc.
      - DISTRIBUTION=0
      - EXEC=0
      - IMAGES=1 # Portainer
      - INFO=1 # Portainer
      - NETWORKS=1 # Portainer
      - NODES=0
      - PLUGINS=0
      - SERVICES=1 # Portainer
      - SESSION=0
      - SWARM=0
      - SYSTEM=0
      - TASKS=1 # Portainer
      - VOLUMES=1 # Portainer
      - DISABLE_IPV6=0 #optional