services:
  telnetd-vulnerable:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: cve-2026-24061-lab
    hostname: telnetd-lab
    # Bind to localhost only to prevent external access
    ports:
      - "127.0.0.1:2323:23"
    # Limit container capabilities (although root is required to run telnetd)
    cap_add:
      - NET_BIND_SERVICE
    # Set resource limits
    mem_limit: 512m
    cpus: 1
    restart: unless-stopped
    # Network isolation
    networks:
      - isolated-lab
    # Add labels for identification
    labels:
      - "cve-2026-24061.lab=vulnerable"
      - "security.warning=for-research-only"

networks:
  isolated-lab:
    driver: bridge
    internal: false
    ipam:
      config:
        - subnet: 172.20.0.0/16