Compose file rules

What a docker-compose.yml may not use on Jambotron: privileged mode, host namespaces, paths outside the project and more.

Every project runs on a shared server, so some Docker features are blocked. A deployment stops with a list of violations if the compose file uses:

  • in services: privileged, cap_add, devices, device_cgroup_rules, gpus, security_opt, sysctls, runtime, cgroup_parent, volumes_from, external_links, oom_kill_disable, provider, use_api_socket, GPU reservations (deploy.resources.reservations.devices), privileged post_start / pre_stop hooks;
  • host namespaces: network_mode, pid, ipc, uts, userns_mode, cgroup set to host or container:…;
  • paths outside the project: bind mounts, env_file, build.context, build.dockerfile, files of secrets / configs — all must stay inside the project folder (so no /var/run/docker.sock, no ../);
  • in build: privileged, entitlements, ssh, secrets, network: host; remote build contexts (URL, git@…);
  • volumes: only the local driver, without driver_opts, no external volumes;
  • networks: only the bridge driver, without driver_opts, no external networks; no external secrets or configs.

Named volumes and images from Docker Hub or other registries work as usual.