services:
  device-backhaul-target:
    image: nodedc/device-backhaul-target:local
    pull_policy: never
    restart: unless-stopped
    network_mode: host
    read_only: true
    tmpfs:
      - /run:size=8m,mode=0755
      - /tmp:size=8m,mode=1777
    volumes:
      - type: bind
        source: /volume1/docker/nodedc-device-plane/secrets/backhaul-target/ssh_host_ed25519_key
        target: /run/nodedc-secrets/ssh_host_ed25519_key
        read_only: true
        bind:
          create_host_path: false
      - type: bind
        source: /volume1/docker/nodedc-device-plane/secrets/backhaul-target/authorized_keys
        target: /run/nodedc-secrets/authorized_keys
        read_only: true
        bind:
          create_host_path: false
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - SETGID
      - SETUID
      - SYS_CHROOT
    healthcheck:
      test: ["CMD", "nc", "-z", "-w", "3", "127.0.0.1", "2222"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 10s