-
Notifications
You must be signed in to change notification settings - Fork 0
/
docker-compose.yml
94 lines (91 loc) · 2.1 KB
/
docker-compose.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
version: '3.8'
services:
freeradius:
image: ghcr.io/glassrom/freeradius-docker:master
read_only: true
container_name: freeradius
user: "970:970"
security_opt:
- no-new-privileges:true
cap_drop:
- ALL
ports:
- "1812:1812/udp"
- "1812:1812/tcp"
- "1813:1813/udp"
- "1813:1813/tcp"
pull_policy: always
volumes:
- type: bind
source: /var/log/radius
target: /var/log/radius
bind:
selinux: z
- type: bind
source: /etc/raddb/certs/server.crt
target: /etc/raddb/certs/server.crt
read_only: true
bind:
selinux: z
- type: bind
source: /etc/raddb/certs/server.pem
target: /etc/raddb/certs/server.pem
read_only: true
bind:
selinux: z
- type: bind
source: /etc/raddb/certs/ca.pem
target: /etc/raddb/certs/ca.pem
read_only: true
bind:
selinux: z
- type: bind
source: /etc/raddb/clients.conf
target: /etc/raddb/clients.conf
read_only: true
bind:
selinux: z
# gvisor DNS fixup
- type: bind
source: /etc/resolv-container-freeradius.conf
target: /etc/resolv.conf
read_only: true
bind:
selinux: z
tmpfs:
- /tmp
restart: always
depends_on:
- unbound-freeradius
networks:
- freeradius_net
runtime: runsc-overlay-host-network
unbound-freeradius:
runtime: runsc-overlay-host-network
image: ghcr.io/glassrom/dns-docker:master
read_only: true
container_name: unbound-freeradius
user: "970:970"
security_opt:
- no-new-privileges:true
cap_drop:
- ALL
cap_add:
- CAP_NET_BIND_SERVICE
- CAP_SYS_RESOURCE
- CAP_NET_RAW
tmpfs:
- /tmp
restart: always
pull_policy: always
networks:
freeradius_net:
ipv4_address: 172.19.0.2
networks:
freeradius_net:
driver: bridge
ipam:
driver: default
config:
- subnet: 172.19.0.0/16
gateway: 172.19.0.1