version: '2' volumes: plain_data: encfs_password: sshd_host_keys: services: encfs: image: fphammerle/reverse-encfs:0.1.1-encfs1.9.5-amd64 volumes: - plain_data:/plain/data:ro - encfs_password:/secret # Currently docker does not allow changing # the mount propagation setting for named volumes. # https://github.com/moby/moby/pull/17034#issuecomment-163361073 # https://github.com/moby/moby/pull/17034/files#diff-6896c3d2994ef80758bb7e38c07eb76bR103 # So we bind mount a host dir instead. - /mnt/encrypted:/encrypted:shared networks: [] devices: [/dev/fuse] cap_add: [SYS_ADMIN] security_opt: ['apparmor:unconfined'] rsync_sshd: image: fphammerle/rsync-sshd:0.1-amd64 environment: USERS: alice volumes: - /mnt/encrypted:/data:slave,ro - sshd_host_keys:/etc/ssh/host_keys - ~/.ssh/authorized_keys:/home/alice/.ssh/authorized_keys:ro ports: ['127.0.0.1:2022:22'] # rsync -av --rsh='ssh -p 2022' alice@localhost:/ encrypted # https://docs.docker.com/compose/compose-file/compose-file-v2/