# Only one service can be running per host.
# If non-host mode networking is supported, CTRL_HTTPS_PORT env is not needed. We can
# simply use 'ports' to map port 443.

controller:
    image: neuvector/controller
    container_name: neuvector.controller
    privileged: true
    #security_opt:
    #    - apparmor:unconfined
    #cap_add:
    #    - SYS_ADMIN
    #    - MAC_ADMIN
    #    - NET_ADMIN
    #    - SETPCAP
    environment:
        - CLUSTER_JOIN_ADDR=10.1.2.1
        - CTRL_PATH_DEBUG=1
    ports:
        - 18300:18300
        - 18301:18301
        - 18301:18301/udp
        - 18400:18400
        - 4443:443
    volumes:
        - /var/neuvector:/var/neuvector
        - /var/run/docker.sock:/var/run/docker.sock
        - /proc:/host/proc:ro

enforcer:
    image: neuvector/enforcer
    container_name: neuvector.enforcer
    privileged: true
    pid: host
    environment:
        - CLUSTER_JOIN_ADDR=10.1.2.1
        - CTRL_PATH_DEBUG=1
    ports:
        - 18301:18301
        - 18301:18301/udp
        - 18401:18401
    volumes:
        - /var/neuvector:/var/neuvector
        - /var/run/docker.sock:/var/run/docker.sock
        - /proc:/host/proc:ro
        - /sys/fs/cgroup/:/host/cgroup/:ro

ctrlenf:
    image: neuvector/ctrlenf
    container_name: neuvector.ctrlenf
    privileged: true
    pid: host
    # cpuset: 2,3
    environment:
        - CLUSTER_JOIN_ADDR=10.1.2.1
        - CTRL_PATH_DEBUG=1
    ports:
        - 18300:18300
        - 18301:18301
        - 18301:18301/udp
        - 18400:18400
        - 4443:443
    volumes:
        - /var/neuvector:/var/neuvector
        - /var/run/docker.sock:/var/run/docker.sock
        - /proc:/host/proc:ro
        - /sys/fs/cgroup/:/host/cgroup/:ro