name: backup-tool-ssh-test

services:
  sshd:
    build:
      context: ./ssh-fixture
      dockerfile: Dockerfile
    read_only: true
    tmpfs:
      - /run/sshd:uid=0,gid=0,mode=0755,size=8m
      - /tmp:mode=1777,size=8m
    cap_drop:
      - ALL
    # sshd needs only these capabilities to chroot then drop to the SFTP account.
    cap_add:
      - SYS_CHROOT
      - SETUID
      - SETGID
      - KILL
    security_opt:
      - no-new-privileges:true
    ports:
      - "127.0.0.1:${SSH_FIXTURE_PORT}:2222"
    volumes:
      - type: bind
        source: ${SSH_FIXTURE_DIR}
        target: /fixture
        read_only: true
      - type: bind
        source: ${SSH_FIXTURE_DIR}/source
        target: /home/backup/data
        read_only: true