Compose files
Found this helpful? Share it:
Found this helpful? Share it:
Paste a Compose file and idapt runs it. Ordinary interpolation like
${TAG} and ${PORT} behaves exactly as it does on your
laptop.
idapt stores the document, not a path to it. That is what lets a container move to another computer: the definition travels with it.
Edit it on the Compose tab. Saving and applying are separate. Save on its own records what should run; Apply makes it so. If someone edited the file on the machine, the next apply overwrites it and the tab shows the difference first.
| Setting | Why | Instead |
|---|---|---|
privileged: true |
Removes nearly every isolation the container has | Grant the specific thing you need, or run it on the host |
Mounting the Docker socket (/var/run/docker.sock) |
Control of the socket is control of the machine | Use container verbs, or run on the host |
network_mode: host |
The container joins the machine's network stack | Publish the port and expose it |
pid: host or ipc: host |
The container can see and signal host processes | Run it on the host if that is what you need |
devices: |
Direct hardware access bypasses the boundary | Run it on the host |
cap_add: |
Added Linux capabilities are an escape route | Run it on the host |
| A bind mount outside the project directory | Reaches host files the container should not see | Use a named volume |
Each refusal names the service and the setting, so you can fix exactly one line.
Some settings are allowed but worth knowing about, such as publishing a port directly on the machine or a writable bind inside the project directory. These show as warnings with a checkbox. Accepting one is recorded in the container's activity feed with what was accepted.
A Compose file that builds from source needs its context. Give idapt a git URL and Docker builds straight from the remote, or let idapt package the directory for you. You never give it a path on the machine.
Never paste a token into environment:. It is stored in the
container's configuration on the machine, copied into every backup, and
readable by anything that can inspect the container.
idapt scans for this on paste and on apply, and offers to store the value as a credential instead. See Give a container a secret.
Related articles
Containers
Run a Docker image or a Compose stack on your computers, and know what survives a restart.
Give a container a secret
Bind a credential by name so the value never appears in a file, a backup, or a chat.
Reaching a container
Expose a container port to yourself, your workspace, or the public, and know what changes when it moves.
Was this helpful?