services:
  docker-socket-proxy-mirror:
    container_name: docker-socket-proxy-mirror
    image: tecnativa/docker-socket-proxy
    restart: "no"
    # No docker.sock mounted deliberately - this container never actually
    # proxies anything, it only exists as a self-hosted-registry mirror
    # build target. Real consumers mount their own socket with their own
    # distinct permission sets.