e25622dac2
`user: nobody`: the least privileged account. `read_only: true`: this container doesn't write anything to the filesystem, this removes a vector. `security_opt`: disallows the container to grab more privileges. `cap_drop`: this container doesn't need any capabilities, drop them. `networks`: put `libreddit` into its own network so it cannot see other containers by default.
24 lines
442 B
YAML
24 lines
442 B
YAML
version: "3.8"
|
|
|
|
services:
|
|
web:
|
|
build: .
|
|
restart: always
|
|
container_name: "libreddit"
|
|
ports:
|
|
- 8080:8080
|
|
user: nobody
|
|
read_only: true
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
networks:
|
|
- libreddit
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--spider", "-q", "--tries=1", "http://localhost:8080/settings"]
|
|
interval: 5m
|
|
timeout: 3s
|
|
|
|
networks:
|
|
libreddit:
|