mirror of
https://github.com/legop3/MultiRoombaRover.git
synced 2026-09-16 09:31:20 -04:00
56 lines
2.3 KiB
YAML
56 lines
2.3 KiB
YAML
# MultiRover production deployment
|
|
#
|
|
# This intentionally contains only the application container. The later update
|
|
# controller will be added as a second service when it exists; keeping it out
|
|
# now means this first deployment pass has no placeholder process or unused
|
|
# privilege.
|
|
name: multirover
|
|
|
|
services:
|
|
server:
|
|
image: ghcr.io/legop3/multiroombarover:latest
|
|
container_name: multirover
|
|
|
|
# Host networking preserves the server's existing LAN behavior and avoids
|
|
# maintaining a second list of TCP, UDP, RTSP, and WebRTC port mappings.
|
|
network_mode: host
|
|
restart: unless-stopped
|
|
stop_grace_period: 20s
|
|
|
|
# SELinux cannot safely relabel the host's system D-Bus socket, and the
|
|
# hardware services also need host-owned USB device nodes. Disable Docker's
|
|
# per-container SELinux label while retaining its namespace, capability,
|
|
# non-root-user, and seccomp isolation. This is narrower than privileged
|
|
# mode and avoids changing labels on shared host resources.
|
|
security_opt:
|
|
- label=disable
|
|
|
|
volumes:
|
|
# Docker owns the volume and initializes it from the image's non-root
|
|
# /data directory. This avoids coupling container permissions to a host
|
|
# account's numeric UID while keeping every persistent file together.
|
|
- data:/data
|
|
|
|
# bluetoothctl talks to the host Bluetooth daemon over this socket. The
|
|
# socket is read-only as a filesystem mount; D-Bus method calls still flow
|
|
# through it normally without exposing the rest of the host D-Bus tree.
|
|
- /run/dbus/system_bus_socket:/run/dbus/system_bus_socket:ro
|
|
|
|
# Kinect USB node numbers change when it reconnects, so expose the bus
|
|
# directory rather than one temporary device path. The existing host udev
|
|
# rule remains responsible for granting the non-root container user access.
|
|
devices:
|
|
- /dev/bus/usb:/dev/bus/usb
|
|
|
|
# Only the Balance Board worker receives this capability through its file
|
|
# capabilities. The Node process remains non-root and the container is not
|
|
# privileged.
|
|
cap_add:
|
|
- NET_ADMIN
|
|
|
|
volumes:
|
|
# Use an explicit name so the same data volume survives Compose project moves
|
|
# or directory renames. Ordinary `docker compose down` does not remove it.
|
|
data:
|
|
name: multirover-data
|