version: '2'

volumes:
  data: {}
  certs: {}

services:
  chrome:
    image: local/chrome
    build: .
    network_mode: bridge
    devices:
      - /dev/dri
      # - /dev/video0
    volumes:
      - /tmp/.X11-unix:/tmp/.X11-unix:ro
      - $XDG_RUNTIME_DIR/pulse:/run/user/1000/pulse
      - data:/data
      - certs:/home/user/.pki/nssdb
      - $HOME/Downloads:/home/user/Downloads
      - /var/run/cups:/var/run/cups:ro
      - /tmp/krb5cc_1000:/tmp/krb5cc_1000:ro
    environment:
      - DISPLAY=unix$DISPLAY
      - PULSE_SERVER=unix:$XDG_RUNTIME_DIR/pulse/native
      # some webapps won't work when the timezone is not properly set, e.g.
      # the ownCloud's (v9.0.0) calendar (v1.0.0.0) does not work correctly
      # the same could happen with Icinga2 web interface
      - TZ=Europe/Amsterdam
    # SYS_ADMIN is NOT required if you run chrome with `--no-sandbox` flag
    # more on CAP_SYS_ADMIN https://lwn.net/Articles/486306/
    cap_add:
      - SYS_ADMIN
      - IPC_LOCK # lock memory to prevent sensitive values from being swapped to disk.
    # Turns off anonymous page swapping
    mem_swappiness: 0
    shm_size: 4G
    # mem_limit: 4G
    # security_opt:
      # - apparmor:docker-ptrace
      # - apparmor:unconfined