Security: restricting mounts only to project files/better per-project isolation.

What problem will this feature address?

I'm trying to utilize Dokploy in what is practically an untrusted environment (multiple untrusted users, e.g. students in a classroom learning setting).

I would like to allow users to be able to manage their own project services (this is already a feature).
However, as an example, the docker compose service allows you to mount and bind to anything in the host as root (this includes the docker socket), practically treating every dokploy user as "root".

I believe this is a security issue in a scenario where human error is prone to happen really often. Any malicious container/compose file may breach the entire system and put the other users at risk.

Describe the solution you'd like

Idea 1:
Isolate + allowlist mounts.
Isolate as in, mounts can only be in relative path and can only access files inside the project.
Allowlist, as in only certain paths are allowed.

Idea 2:
Utilise Docker in Docker or rootless Docker on a per-project basis for isolation.

In the ideal scenario, each project should have it's own "clean environment" that cannot tamper with:

1. The host
2. Other users/projects

In the ideal scenario, this would include host ports as well. Being able to allocate host ports to be routed into a project would be desirable, but is not within scope of this feature request.

Describe alternatives you've considered

I have considered using Micro-VMs as alternatives, but it seems to be an overcomplicated solution to isolate between projects.

Additional context

No response

Will you send a PR to implement it?

No

Start by locating the Docker Compose service and its mount handling; compare the relative-path and allowlist requirements with the Docker-in-Docker or rootless Docker options described. Done means projects cannot access the host or other projects, while host-port allocation remains out of scope.