services:
  tor_yggdrasil:
    image: tor_yggdrasil:latest
    container_name: tor_over_yggdrasil
    cap_add:
      - NET_ADMIN  # Required for network tunnel management
    security_opt:
      - no-new-privileges:true  # Security enhancement - prevent privilege escalation
    devices:
      - /dev/net/tun:/dev/net/tun  # TUN device for Yggdrasil network interface
    ports:
      - "127.0.0.1:9050:9050/tcp"   # SOCKS5 proxy port (Tor) for application-level traffic
      - "10655:10655/tcp" # Yggdrasil peer connections  
    environment:
      - YGGDRASIL_GENERATE_KEYS=true  # Generate new Yggdrasil keys on startup
    restart: unless-stopped  # Auto-restart unless manually stopped