docker-compose.dev.yml

# SeedSync Development Docker Compose
#
# Usage:
#   docker compose -f docker-compose.dev.yml build
#   docker compose -f docker-compose.dev.yml up
#
# Access the web UI at: http://localhost:8800

services:
  seedsync:
    build:
      context: .
      dockerfile: src/docker/build/docker-image/Dockerfile
    container_name: seedsync-dev
    ports:
      - "8800:8800"
    environment:
      # Set these to match your host user's UID/GID
      # Run 'id' command to find your values
      - PUID=1000
      - PGID=1000
    volumes:
      # Configuration storage (persists settings)
      - ./dev-config:/config
      # Download destination
      - ./dev-downloads:/downloads
      # Uncomment to use SSH key authentication
      # - ~/.ssh/id_rsa:/home/seedsync/.ssh/id_rsa:ro
    restart: unless-stopped
    # --- Hardened runtime baseline (audit #528) ---
    # entrypoint.sh briefly runs as root to create the PUID/PGID user and
    # chown /config, then drops to that non-root user via setpriv. setpriv
    # only *drops* privileges, so it stays compatible with no-new-privileges.
    security_opt:
      - no-new-privileges:true
    # Drop all Linux capabilities, then add back only the ones the entrypoint
    # needs at startup:
    #   CHOWN, FOWNER, DAC_OVERRIDE - create & chown the user's dirs and /config
    #   SETUID, SETGID              - create the user/group and setpriv into it
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - SETUID
      - SETGID
      - DAC_OVERRIDE
      - FOWNER

# Uncomment below for a test remote server (for development only)
#  test-remote:
#    image: atmoz/sftp
#    container_name: seedsync-test-remote
#    ports:
#      - "2222:22"
#    volumes:
#      - ./dev-remote-files:/home/testuser/files
#    command: testuser:testpass:1000