services:
  filebrowser-init:
    image: filebrowser/filebrowser:v2.63.5
    container_name: cve-2026-54088-hook-auth-init
    user: "0:0"
    volumes:
      - ./data:/database
      - ./srv:/srv
      - ./scripts:/scripts:ro
    entrypoint: ["/bin/sh", "/scripts/init-filebrowser.sh"]
    restart: "no"

  filebrowser:
    image: filebrowser/filebrowser:v2.63.5
    container_name: cve-2026-54088-hook-auth-vuln
    user: "0:0"
    depends_on:
      filebrowser-init:
        condition: service_completed_successfully
    ports:
      - "8080:80"
    volumes:
      - ./data:/database
      - ./srv:/srv
    command:
      - "--database"
      - "/database/filebrowser.db"
      - "--address"
      - "0.0.0.0"
      - "--port"
      - "80"
      - "--root"
      - "/srv"
    restart: unless-stopped