2026-04-27 11:41:59 -04:00
|
|
|
services:
|
|
|
|
|
arch-dev:
|
2026-05-10 23:07:03 -04:00
|
|
|
build:
|
|
|
|
|
context: .
|
|
|
|
|
args:
|
|
|
|
|
USER_UID: ${UID:-1000}
|
|
|
|
|
USER_GID: ${GID:-1000}
|
2026-04-27 11:41:59 -04:00
|
|
|
image: arch-dev:latest
|
|
|
|
|
container_name: arch-dev
|
|
|
|
|
hostname: arch-dev
|
|
|
|
|
stdin_open: true
|
|
|
|
|
tty: true
|
|
|
|
|
|
|
|
|
|
volumes:
|
|
|
|
|
- ./workspace:/workspace
|
|
|
|
|
- arch-dev-home:/home/dev
|
|
|
|
|
|
|
|
|
|
environment:
|
|
|
|
|
- TERM=xterm-256color
|
|
|
|
|
- MOBILE=${MOBILE:-0}
|
|
|
|
|
- GIT_AUTHOR_NAME=${GIT_NAME:-dev}
|
|
|
|
|
- GIT_AUTHOR_EMAIL=${GIT_EMAIL:-dev@localhost}
|
|
|
|
|
- GIT_COMMITTER_NAME=${GIT_NAME:-dev}
|
|
|
|
|
- GIT_COMMITTER_EMAIL=${GIT_EMAIL:-dev@localhost}
|
|
|
|
|
|
2026-06-27 19:20:20 -04:00
|
|
|
# Capability set — cap_drop ALL then re-add only what's needed
|
2026-04-27 11:41:59 -04:00
|
|
|
cap_drop:
|
|
|
|
|
- ALL
|
|
|
|
|
cap_add:
|
2026-05-10 23:07:03 -04:00
|
|
|
- NET_BIND_SERVICE # mosh, bind <1024
|
|
|
|
|
- SETUID # sudo
|
|
|
|
|
- SETGID # sudo
|
|
|
|
|
- AUDIT_WRITE # sudoers_audit plugin
|
|
|
|
|
- NET_ADMIN # tailscale
|
|
|
|
|
- NET_RAW # tailscale
|
2026-06-27 19:20:20 -04:00
|
|
|
- CHOWN # pacman
|
|
|
|
|
- DAC_OVERRIDE # pacman
|
|
|
|
|
- FOWNER # pacman
|
|
|
|
|
- SYS_ADMIN # sshfs/FUSE mounts (roaming ~)
|
2026-04-27 22:34:44 -04:00
|
|
|
|
2026-06-27 19:20:20 -04:00
|
|
|
# Devices: tun for tailscale, fuse for sshfs
|
2026-04-27 22:34:44 -04:00
|
|
|
devices:
|
|
|
|
|
- /dev/net/tun:/dev/net/tun
|
2026-06-27 19:20:20 -04:00
|
|
|
- /dev/fuse:/dev/fuse
|
|
|
|
|
|
|
|
|
|
# FUSE mounts need apparmor unconfined on many hosts
|
|
|
|
|
# (remove if your host doesn't use apparmor)
|
|
|
|
|
security_opt:
|
|
|
|
|
- apparmor:unconfined
|
2026-04-27 11:41:59 -04:00
|
|
|
|
|
|
|
|
volumes:
|
|
|
|
|
arch-dev-home:
|
