`user: nobody`: the least privileged account.
`read_only: true`: this container doesn't write anything to the filesystem, this removes a vector.
`security_opt`: disallows the container to grab more privileges.
`cap_drop`: this container doesn't need any capabilities, drop them.
`networks`: put `rimgo` into its own network so it cannot see other containers by default.
Reviewed-on: https://codeberg.org/video-prize-ranch/rimgo/pulls/99
Co-authored-by: kuantum <kuantum@noreply.codeberg.org>
Co-committed-by: kuantum <kuantum@noreply.codeberg.org>
video-prize-ranch
kuantum
TheFrenchGhosty