portainer-compose.yml

# ----------------------------------------------------------
# Portainer is a web GUI for container management.
# This compose file is used in Synology's Container Manager,
# since Portainer can't be used to edit itself.
# ----------------------------------------------------------

# quick network info:
# - subnet: 172.21.0.0/24
# - port: 2376

services:
  # use docker-socket-proxy for portainer's Docker access
  portainer-socket-proxy:
    image: tecnativa/docker-socket-proxy
    container_name: portainer-socket-proxy
    security_opt:
      - no-new-privileges:true
    networks: # uses the socket proxy network
      portainer_socket_network:
        ipv4_address: 172.21.0.10  # assign a static IP for firewall ease
    privileged: true
    ports:
      - 2376:2375
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - LOG_LEVEL=info
      - POST=1
      - CONTAINERS=1
      - IMAGES=1
      - INFO=1
      - NETWORKS=1
      - SERVICES=1
      - TASKS=1
      - VOLUMES=1
    labels:
      - "com.centurylinklabs.watchtower.monitor-only=true"
    restart: unless-stopped

  portainer:
    image: portainer/portainer-ce:latest
    container_name: portainer
    ports:
      - 8000:8000
      - 9000:9000
    depends_on:
      - portainer-socket-proxy
    command: -H tcp://portainer-socket-proxy:2375
    security_opt:
      - no-new-privileges:true
    volumes:
      - /volume1/docker/portainer:/data
    networks:
      portainer_socket_network:
        ipv4_address: 172.21.0.11  # assign a static IP for firewall ease
    labels:
      io.portainer.accesscontrol.users: matthewkdies
    restart: unless-stopped

networks:
  portainer_socket_network:
    # a custom network that all docker socket requests are routed through
    name: portainer_socket_network
    driver: bridge
    ipam:
      config:
        - subnet: "172.21.0.0/24"
          gateway: "172.21.0.1"
          ip_range: "172.21.0.0/24"