services:
  portainer:
    image: portainer/portainer-ce:2.45.3-alpine
    container_name: portainer
    restart: unless-stopped
    ports:
      - "${PORTAINER_HTTPS_PORT:-9443}:9443"   # web UI (HTTPS)
      # - "8000:8000"                          # edge agents (optional)
      # - "9000:9000"                          # legacy HTTP: avoid, conflicts with the deployer
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer-data:/data
    security_opt:
      - no-new-privileges:true

volumes:
  portainer-data: