From 9b5af0aeb6250a62ccafb0a146c6506882e6940a Mon Sep 17 00:00:00 2001 From: kuantum Date: Tue, 28 Mar 2023 21:33:03 +0000 Subject: [PATCH] harden docker-compose.yml (#99) `user: nobody`: the least privileged account. `read_only: true`: this container doesn't write anything to the filesystem, this removes a vector. `security_opt`: disallows the container to grab more privileges. `cap_drop`: this container doesn't need any capabilities, drop them. `networks`: put `rimgo` into its own network so it cannot see other containers by default. Reviewed-on: https://codeberg.org/video-prize-ranch/rimgo/pulls/99 Co-authored-by: kuantum Co-committed-by: kuantum --- docker-compose.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/docker-compose.yml b/docker-compose.yml index 3369fd5..fc44fbb 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -8,3 +8,14 @@ services: ports: - 3000:3000 restart: unless-stopped + user: 65534:65534 # equivalent to `nobody` + read_only: true + security_opt: + - no-new-privileges: true + cap_drop: + - ALL + networks: + - rimgo + +networks: + - rimgo \ No newline at end of file