Merge 77c8b9dd4c into 11407973b1

docker-compose.yml

@@ -49,8 +49,6 @@ services:
         - "${REDIS_PORT:-127.0.0.1:7654}:6379"
       environment:
         - TZ=${TZ}
-      sysctls:
-        - net.core.somaxconn=4096
       networks:
         mailcow-network:
           ipv4_address: ${IPV4_NETWORK:-172.22.1}.249
@@ -285,11 +283,6 @@ services:
         ofelia.job-exec.dovecot_fts.command: "/usr/bin/curl http://solr:8983/solr/dovecot-fts/update?optimize=true"
         ofelia.job-exec.dovecot_repl_health.schedule: "@every 5m"
         ofelia.job-exec.dovecot_repl_health.command: "/bin/bash -c \"/usr/local/bin/gosu vmail /usr/local/bin/repl_health.sh\""
-      ulimits:
-        nproc: 65535
-        nofile:
-          soft: 20000
-          hard: 40000
       networks:
         mailcow-network:
           ipv4_address: ${IPV4_NETWORK:-172.22.1}.250
@@ -435,7 +428,6 @@ services:
         - php-fpm-mailcow
         - redis-mailcow
       restart: always
-      privileged: true
       environment:
         - TZ=${TZ}
         - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
@@ -444,7 +436,6 @@ services:
         - SNAT6_TO_SOURCE=${SNAT6_TO_SOURCE:-n}
         - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
         - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
-      network_mode: "host"
       volumes:
         - /lib/modules:/lib/modules:ro
 
@@ -523,7 +514,7 @@ services:
         - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
         - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
       volumes:
-        - /var/run/docker.sock:/var/run/docker.sock:ro
+        - /run/user/${CURRENT_USER_ID:?}/docker.sock:/var/run/docker.sock:ro
       networks:
         mailcow-network:
           aliases:
@@ -577,7 +568,7 @@ services:
       security_opt:
         - label=disable
       volumes:
-        - /var/run/docker.sock:/var/run/docker.sock:ro
+        - /run/user/${CURRENT_USER_ID:?}/docker.sock:/var/run/docker.sock:ro
       networks:
         mailcow-network:
           aliases:
@@ -607,10 +598,8 @@ services:
       security_opt:
         - label=disable
       restart: always
-      privileged: true
-      network_mode: "host"
       volumes:
-        - /var/run/docker.sock:/var/run/docker.sock:ro
+        - /run/user/${CURRENT_USER_ID:?}/docker.sock:/var/run/docker.sock:ro
         - /lib/modules:/lib/modules:ro
 
 networks:

generate_config.sh

@@ -431,6 +431,9 @@ ACME_CONTACT=
 # root certificates can be placed for validation under mailcow-dockerized/data/web/inc/lib/WebAuthn/rootCertificates
 WEBAUTHN_ONLY_TRUSTED_VENDORS=n
 
+# To mount rootless docker.sock we need to know current user id
+CURRENT_USER_ID=$UID
+
 EOF
 
 mkdir -p data/assets/ssl