# A container should be run on the same docker network as the service(s) using it. 
# Most containers that would normally connect to a mounted docker.sock can have their endpoint overridden using the DOCKER_HOST environment variable 
# if they do not offer the option in their configuration; it should typically be pointed to tcp://socket-proxy:2375.
# Never expose this container's port to a public network. It should be treated the same way you would treat the docker socket or TCP endpoint.

# The container should be run on the same docker network as the service(s) using it. 
# Most containers that would normally connect to a mounted docker.sock can have their endpoint overridden using the DOCKER_HOST environment variable 
# if they do not offer the option in their configuration; it should typically be pointed to tcp://socket-proxy:2375.
services:
  socket-proxy:   # socket-proxy for Docker API
    image: lscr.io/linuxserver/socket-proxy:latest
    container_name: socket-proxy
    restart: unless-stopped
    read_only: true      # Make the container filesystem read-only
    tmpfs:
      - /run
    ports:
      - "2375:2375"
    volumes:
      # mount host docker socket, the :ro does not mean read-only for the socket, just for the actual file
      - "/run/docker.sock:/run/docker.sock:ro"
    environment:     
      - TZ=America/Chicago
      #- LOG_LEVEL=debug    #optional - function: Possible values are: debug, info, notice, warning, err, crit, alert and emerg. Defaults to info.
      ### DOCKER FUNCTIONS ###
      - ALLOW_START=0      #optional - function: /containers/{id}/start - This option will work even if POST=0 # needed for dockhand functionality
      - ALLOW_STOP=0       #optional - function: /containers/{id}/stop - This option will work even if POST=0 # needed for dockhand functionality
      - ALLOW_RESTARTS=1   #optional - function: /containers/{id}/stop, /containers/{id}/restart, and /containers/{id}/kill - This option will work even if POST=0 - Needed for docker volume backup and automated watchtower and 
      #- CONFIGS=0          #optional - function: /configs
      - CONTAINERS=1        #optional - Allow listing and managing containers
      #- DISABLE_IPV6=0     #optional - function: Set to 1 to prevent binding to the IPv6 interface for legacy systems that cannot support IPv6.
      - IMAGES=1            #optional - Allow listing images
      - INFO=1              #optional - Allow info
      - NETWORKS=1          #optional - Allow listing networks
      - PING=1              #optional - Allow ping
      - POST=1              #optional - function:  When set to 0, only GET and HEAD operations are allowed, making API access read-only.   <-- This is needed for "Check for updates" operations in dockpeek
      - SERVICES=1          #optional - Allow listing and managing services
      - VERSION=1           #optional - Allow listing version
      - VOLUMES=1           #optional - Allow listing volumes
      - EXEC=1              #optional - Disable exec command for security, enable for terminal access (dockhand)
      - DF=1                # needed for dockhand functionality - disk space info
      # Optional (safe to enable)
      - EVENTS=1
      - SYSTEM=1
      # Keep these OFF
      - AUTH=0
      - SECRETS=0
      #- POST=0 
      #- BUILD=0
       # Required for dockhand compose stack management
      - DELETE=1
      - BUILD=1
      - TASKS=1
      - DISTRIBUTION=1
    labels:
      - rackpeek.name=socket-proxy
      - rackpeek.tags=database
    networks:
      - socket-net

networks:
  socket-net:
    external: true