rimgo/docker-compose.yml

version: '3'

services:
  rimgo:
    image: codeberg.org/rimgo/rimgo # Official image
    #image: quay.io/pussthecatorg/rimgo # Unofficial image
    #build: . # Uncomment to build from source
    ports:
      - 3000:3000
    restart: unless-stopped
    user: 65534:65534 # equivalent to `nobody`
    read_only: true
    security_opt:
      - no-new-privileges
    cap_drop:
      - ALL
    env_file: .env
Basic docker support 2022-01-17 22:33:51 +00:00			`version: '3'`

			`services:`
			`rimgo:`
Update image 2023-07-20 02:19:25 +00:00			`image: codeberg.org/rimgo/rimgo # Official image`
Add official image to docker-compose 2022-03-19 20:00:48 +00:00			`#image: quay.io/pussthecatorg/rimgo # Unofficial image`
Add section on automatic updates and use image by default [ci skip] 2022-08-13 01:22:46 +00:00			`#build: . # Uncomment to build from source`
Basic docker support 2022-01-17 22:33:51 +00:00			`ports:`
			`- 3000:3000`
			`restart: unless-stopped`
harden docker-compose.yml (#99) `user: nobody`: the least privileged account. `read_only: true`: this container doesn't write anything to the filesystem, this removes a vector. `security_opt`: disallows the container to grab more privileges. `cap_drop`: this container doesn't need any capabilities, drop them. `networks`: put `rimgo` into its own network so it cannot see other containers by default. Reviewed-on: https://codeberg.org/video-prize-ranch/rimgo/pulls/99 Co-authored-by: kuantum <kuantum@noreply.codeberg.org> Co-committed-by: kuantum <kuantum@noreply.codeberg.org> 2023-03-28 21:33:03 +00:00			user: 65534:65534 # equivalent to `nobody`
			`read_only: true`
			`security_opt:`
Fix docker-compose file 2023-07-19 23:50:51 +00:00			`- no-new-privileges`
harden docker-compose.yml (#99) `user: nobody`: the least privileged account. `read_only: true`: this container doesn't write anything to the filesystem, this removes a vector. `security_opt`: disallows the container to grab more privileges. `cap_drop`: this container doesn't need any capabilities, drop them. `networks`: put `rimgo` into its own network so it cannot see other containers by default. Reviewed-on: https://codeberg.org/video-prize-ranch/rimgo/pulls/99 Co-authored-by: kuantum <kuantum@noreply.codeberg.org> Co-committed-by: kuantum <kuantum@noreply.codeberg.org> 2023-03-28 21:33:03 +00:00			`cap_drop:`
			`- ALL`
Fix docker-compose file 2023-07-19 23:50:51 +00:00			`env_file: .env`