docker-compose-crowdsec.yml

services:
  crowdsec:
    image: crowdsecurity/crowdsec:v1.6.2 ## container labels were introduced in 1.6.2
    restart: always
    networks:
      crowdsec:
    environment:
      DOCKER_HOST: tcp://socket-proxy:2375
      COLLECTIONS: "crowdsecurity/nginx"
    ports:
      - "127.0.0.1:8080:8080"
    depends_on:
      - 'socket-proxy'
    volumes:
      - ./crowdsec/acquis.yaml:/etc/crowdsec/acquis.yaml
      - crowdsec-db:/var/lib/crowdsec/data/
      - crowdsec-config:/etc/crowdsec/

  socket-proxy:
    networks:
      crowdsec:
    restart: always
    image: lscr.io/linuxserver/socket-proxy:latest
    container_name: socket-proxy
    environment:
      - ALLOW_START=0 #optional
      - ALLOW_STOP=0 #optional
      - ALLOW_RESTARTS=0 #optional
      - AUTH=0 #optional
      - BUILD=0 #optional
      - COMMIT=0 #optional
      - CONFIGS=0 #optional
      - CONTAINERS=1 #optional
      - DISABLE_IPV6=0 #optional
      - DISTRIBUTION=0 #optional
      - EVENTS=1 #optional
      - EXEC=0 #optional
      - IMAGES=0 #optional
      - INFO=1 #optional
      - LOG_LEVEL=info #optional
      - NETWORKS=0 #optional
      - NODES=0 #optional
      - PING=1 #optional
      - PLUGINS=0 #optional
      - POST=0 #optional
      - SECRETS=0 #optional
      - SERVICES=0 #optional
      - SESSION=0 #optional
      - SWARM=0 #optional
      - SYSTEM=0 #optional
      - TASKS=0 #optional
      - VERSION=1 #optional
      - VOLUMES=0 #optional
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock:ro'
    read_only: true
    tmpfs:
      - /run

volumes:
  crowdsec-db:
  crowdsec-config:

networks:
  crowdsec:
    driver: bridge