mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-02-18 00:17:39 +01:00
cc5e6f3a09
BREAKING CHANGE: Socket directory now mounted read-only into containers for security. Prevents compromised containers from: - Unlinking socket and creating man-in-the-middle proxies - Filling /run/pulse-sensor-proxy/ to exhaust tmpfs - Racing proxy service on restart to hijack socket path Migration: Change socket mounts from :rw to :ro in docker-compose.yml Access control enforced via SO_PEERCRED, so write access not needed. Related to security audit 2025-11-07.
28 lines
823 B
YAML
28 lines
823 B
YAML
version: '3.8'
|
|
|
|
services:
|
|
pulse:
|
|
image: ${PULSE_IMAGE:-rcourtman/pulse:latest}
|
|
container_name: pulse
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${PULSE_PORT:-7655}:7655"
|
|
volumes:
|
|
- pulse-data:/data
|
|
# Secure temperature monitoring via host-side proxy (requires setup - see docs)
|
|
# Uncomment after installing pulse-sensor-proxy on host with --standalone flag
|
|
# Mount is read-only (:ro) for security - proxy uses SO_PEERCRED for access control
|
|
# - /run/pulse-sensor-proxy:/run/pulse-sensor-proxy:ro
|
|
environment:
|
|
- TZ=${TZ:-UTC}
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:7655/api/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 10s
|
|
|
|
volumes:
|
|
pulse-data:
|
|
driver: local
|