services:
  socket_proxy:
    image: ghcr.io/tecnativa/docker-socket-proxy@sha256:1f5038b54f06c3e18422902cf00ba21803d1c97805aae032e5e6673d532d3459
    container_name: socket_proxy
    restart: unless-stopped
    environment:
      # Required for Dockhand core functionality
      - CONTAINERS=1
      - IMAGES=1
      - NETWORKS=1
      - VOLUMES=1
      - EVENTS=1
      - POST=1
      - DELETE=1
      # Required for dashboard host info and disk usage
      - INFO=1
      - SYSTEM=1
      # Required for vulnerability scanning
      - ALLOW_START=1
      - ALLOW_STOP=1
      - ALLOW_RESTARTS=1
      # Optional: enable for the container terminal, volume browsing,
      # and the in-container file browser (all use the Docker exec API)
      - EXEC=1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - socket_proxy

  dockhand:
    image: fnsys/dockhand:latest
    container_name: dockhand
    restart: unless-stopped
    user: "1000:1000"
    depends_on:
      - socket_proxy
    ports:
      - "3000:3000"
    volumes:
      - /opt/dockhand:/opt/dockhand
    environment:
      - DATA_DIR=/opt/dockhand
      - ENCRYPTION_KEY=${DOCKHAND_ENCRYPTION_KEY?Add encryption key to .env file}
      - EXPORT_METRICS=true
    networks:
      - socket_proxy
      - default

networks:
  socket_proxy:
    internal: true