services:
  sablier-socket-protector:
    image: lscr.io/linuxserver/socket-proxy
    hostname: sablier-socket-protector
    container_name: sablier-socket-protector
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: 128M
    tmpfs:
      - /run
      - /tmp
    read_only: true
    cap_drop: [ all ]
    environment:
      - CONTAINERS=1
      - ALLOW_START=1
      - ALLOW_STOP=1
      # Security critical
      - AUTH=0
      - SECRETS=0
      - POST=0
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - sablier_docker_proxy
    security_opt:
      - no-new-privileges=true
      
  sablier:
    image: sablierapp/sablier:latest
    container_name: sablier
    command:
      - start
      - --provider.name=docker
    networks:
      - caddy
      - sablier_docker_proxy
    environment:
      - DOCKER_HOST=tcp://sablier-socket-protector:2375
    security_opt:
      - no-new-privileges=true
    restart: on-failure:5
    read_only: true

networks:
  caddy:
    external: true
  sablier_docker_proxy:
    internal: true