HH-738: add constrained browser container control (#4)

2026-08-27 18:07:34 +08:00
parent 8aa194b264
commit 4b054d6f04
16 changed files with 1925 additions and 1 deletions
@@ -0,0 +1,38 @@
+services:
+  creator-hub:
+    build: .
+    environment:
+      DOCKER_GATEWAY_URL: http://docker-gateway:8081
+    ports:
+      - "127.0.0.1:${CREATORHUB_PORT:-8080}:8080"
+    read_only: true
+    tmpfs:
+      - /tmp:size=16m,noexec,nosuid,nodev
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
+    depends_on: [docker-gateway]
+    networks: [control]
+    restart: unless-stopped
+
+  docker-gateway:
+    build: .
+    command: ["/app/docker-gateway"]
+    environment:
+      BROWSER_IMAGE: ${BROWSER_IMAGE:-git.ipao.vip/rogee/fingerprint-chromium:148.0.7778.215}
+      BROWSER_NETWORK: creatorhub_browser
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    group_add:
+      - "${DOCKER_GID:-999}"
+    read_only: true
+    tmpfs:
+      - /tmp:size=16m,noexec,nosuid,nodev
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
+    networks: [control]
+    restart: unless-stopped
+
+networks:
+  control:
+    name: creatorhub_control
+    internal: true