docker-compose.yaml

volumes:
  ssh-config:
  sftp-data:

services:
  config:
    image: sftp-sftp
    cap_add:
      - LINUX_IMMUTABLE
      - CHOWN
      - DAC_OVERRIDE
    profiles:
      - config
    volumes:
      - ssh-config:/etc/ssh
    entrypoint: ""

  sftp:
    image: sftp-sftp
    build:
      context: ./
    restart: unless-stopped
    volumes:
      - ssh-config:/etc/ssh
      - sftp-data:/data
    ports:
      - ${SFTP_PORT}:2000
    environment:
      - SFTP_KEYFILE_URL
      - SFTP_USERS
    labels:
      - "backup-volume.stop-during-backup=true"
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
       - CHOWN
       - DAC_OVERRIDE
       - SYS_CHROOT
       - AUDIT_WRITE
       - SETGID
       - SETUID
       - FOWNER
       - KILL
       ### Unused capabilities:
       # - AUDIT_CONTROL
       # - AUDIT_READ
       # - BLOCK_SUSPEND
       # - DAC_READ_SEARCH
       # - FSETID
       # - IPC_LOCK
       # - IPC_OWNER
       # - LEASE
       # - LINUX_IMMUTABLE
       # - MAC_ADMIN
       # - MAC_OVERRIDE
       # - MKNOD
       # - NET_ADMIN
       # - NET_BIND_SERVICE
       # - NET_BROADCAST
       # - NET_RAW
       # - SETFCAP
       # - SETPCAP
       # - SYS_ADMIN
       # - SYS_BOOT
       # - SYSLOG
       # - SYS_MODULE
       # - SYS_NICE
       # - SYS_PACCT
       # - SYS_PTRACE
       # - SYS_RAWIO
       # - SYS_RESOURCE
       # - SYS_TIME
       # - SYS_TTY_CONFIG
       # - WAKE_ALARM