# Managed by Ansible (role xray). Root in the container only to read the
# 0600 config and bind :443; every other capability is dropped.
services:
  xray:
    image: ghcr.io/xtls/xray-core:{{ xray_version }}
    container_name: xray
    command: ["run", "-c", "/etc/xray/config.json"]
    network_mode: host
    user: "0"
    cap_drop: [ALL]
    cap_add: [NET_BIND_SERVICE]
    security_opt: ["no-new-privileges:true"]
    read_only: true
    volumes:
      - ./config.json:/etc/xray/config.json:ro
    restart: unless-stopped