From 34215a282a011c6ebd78be191a2a6feb5fee1768 Mon Sep 17 00:00:00 2001
From: wYw <detavern@live.com>
Date: Sat, 19 Apr 2025 22:42:14 +0800
Subject: [PATCH] docs: limit priviledged container (#117)

* docs: limit priviledged container

* docs: improve installation via docker compose
---
 en/guide/installation.md | 26 +++++++++++++++-----------
 guide/installation.md    | 26 +++++++++++++++-----------
 2 files changed, 30 insertions(+), 22 deletions(-)

diff --git a/en/guide/installation.md b/en/guide/installation.md
index a878e06..168200e 100644
--- a/en/guide/installation.md
+++ b/en/guide/installation.md
@@ -27,29 +27,33 @@
    ```yaml [docker-compose.yml]
    services:
      watchtower: # Used to automatically update the easytier image, delete this part if not needed
-       command: --interval 3600 --cleanup --label-enable
+       image: containrrr/watchtower
        container_name: watchtower
+       restart: unless-stopped
        environment:
          - TZ=Asia/Shanghai
          - WATCHTOWER_NO_STARTUP_MESSAGE
-       image: containrrr/watchtower
-       restart: always
        volumes:
          - /var/run/docker.sock:/var/run/docker.sock
+       command: --interval 3600 --cleanup --label-enable
      easytier:
-       restart: always
+       image: easytier/easytier:latest
+       hostname: easytier
+       container_name: easytier
        labels:
          com.centurylinklabs.watchtower.enable: 'true'
-       privileged: true
-       mem_limit: 0m
-       container_name: easytier
-       hostname: easytier
+       restart: unless-stopped
        network_mode: host
-       volumes:
-         - /etc/easytier:/root
+       cap_add:
+         - NET_ADMIN
+         - NET_RAW
        environment:
          - TZ=Asia/Shanghai
-       image: easytier/easytier:latest
+       devices:
+         - /etc/machine-id:/etc/machine-id:ro # Pass the host's machine id into container
+         - /dev/net/tun:/dev/net/tun
+       volumes:
+         - /etc/easytier:/root
        command: -i <ip> --network-name <user> --network-secret <password> -p tcp://<server_address>:11010
    ```
 
diff --git a/guide/installation.md b/guide/installation.md
index 76ef202..91ff51c 100644
--- a/guide/installation.md
+++ b/guide/installation.md
@@ -31,29 +31,33 @@
    ```yaml [docker-compose.yml]
    services:
      watchtower: # 用于自动更新easytier镜像，若不需要请删除这部分
-       command: --interval 3600 --cleanup --label-enable
+       image: containrrr/watchtower
        container_name: watchtower
+       restart: unless-stopped
        environment:
          - TZ=Asia/Shanghai
          - WATCHTOWER_NO_STARTUP_MESSAGE
-       image: containrrr/watchtower
-       restart: always
        volumes:
          - /var/run/docker.sock:/var/run/docker.sock
+       command: --interval 3600 --cleanup --label-enable
      easytier:
-       restart: always
+       image: easytier/easytier:latest # 国内用户可以使用 m.daocloud.io/docker.io/easytier/easytier:latest
+       hostname: easytier
+       container_name: easytier
        labels:
          com.centurylinklabs.watchtower.enable: 'true'
-       privileged: true
-       mem_limit: 0m
-       container_name: easytier
-       hostname: easytier
+       restart: unless-stopped
        network_mode: host
-       volumes:
-         - /etc/easytier:/root
+       cap_add:
+         - NET_ADMIN
+         - NET_RAW
        environment:
          - TZ=Asia/Shanghai
-       image: easytier/easytier:latest # 国内用户可以使用 m.daocloud.io/docker.io/easytier/easytier:latest
+       devices:
+         - /etc/machine-id:/etc/machine-id:ro # 映射宿主机机器码
+         - /dev/net/tun:/dev/net/tun
+       volumes:
+         - /etc/easytier:/root
        command: -i <ip> --network-name <用户> --network-secret <密码> -p tcp://<服务器地址>:11010
    ```