docker run --detach --restart=always --privileged=true --net=host --volume /var/lib/candy:/var/lib/candy docker.io/lanthora/candy:latest

services:
  candy:
    image: lanthora/candy
    network_mode: "host"
    cap_add:
      - NET_ADMIN
    devices:
      - "/dev/net/tun:/dev/net/tun"
    restart: always
    volumes:
      - /var/lib/candy:/var/lib/candy