harden docker-compose
This commit is contained in:
parent
cac97ff05e
commit
48eccbc5ec
|
@ -18,13 +18,47 @@ services:
|
|||
depends_on:
|
||||
- redis
|
||||
- signer
|
||||
networks:
|
||||
- proxitok
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
cap_drop:
|
||||
- ALL
|
||||
cap_add:
|
||||
- CHOWN
|
||||
- SETGID
|
||||
- SETUID
|
||||
|
||||
redis:
|
||||
container_name: proxitok-redis
|
||||
image: redis:7-alpine
|
||||
command: redis-server --save 60 1 --loglevel warning
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- proxitok
|
||||
user: nobody
|
||||
read_only: true
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
tmpfs:
|
||||
- /data:size=10M,mode=0770,uid=65534,gid=65534,noexec,nosuid,nodev
|
||||
cap_drop:
|
||||
- ALL
|
||||
|
||||
signer:
|
||||
container_name: proxitok-signer
|
||||
image: ghcr.io/pablouser1/signtok:master
|
||||
networks:
|
||||
- proxitok
|
||||
user: nobody
|
||||
read_only: true
|
||||
security_opt:
|
||||
- no-new-privileges:true
|
||||
cap_drop:
|
||||
- ALL
|
||||
|
||||
volumes:
|
||||
proxitok-cache:
|
||||
|
||||
networks:
|
||||
proxitok:
|
||||
|
|
Loading…
Reference in a new issue