redlib/docker-compose.yml

version: "3.8"

services:
  web:
    image: quay.io/redlib/redlib
    # quay.io/redlib/redlib:latest-arm # uncomment if you use arm64
    # quay.io/redlib/redlib:latest-armv7 # uncomment if you use armv7
    restart: always
    container_name: "redlib"
    ports:
      - 8080:8080
    user: nobody
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    networks:
      - redlib
    security_opt:
      - seccomp="seccomp-redlib.json"
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "--tries=1", "http://localhost:8080/settings"]
      interval: 5m
      timeout: 3s

networks:
  redlib:
Example docker-compose 2021-03-31 13:03:18 -07:00			`version: "3.8"`

			`services:`
			`web:`
use official image 2024-01-26 17:03:56 +01:00			`image: quay.io/redlib/redlib`
			`# quay.io/redlib/redlib:latest-arm # uncomment if you use arm64`
			`# quay.io/redlib/redlib:latest-armv7 # uncomment if you use armv7`
Example docker-compose 2021-03-31 13:03:18 -07:00			`restart: always`
Libreddit -> Redlib 2023-12-26 18:25:52 -05:00			`container_name: "redlib"`
Example docker-compose 2021-03-31 13:03:18 -07:00			`ports:`
			`- 8080:8080`
harden docker-compose.yml (#760) `user: nobody`: the least privileged account. `read_only: true`: this container doesn't write anything to the filesystem, this removes a vector. `security_opt`: disallows the container to grab more privileges. `cap_drop`: this container doesn't need any capabilities, drop them. `networks`: put `libreddit` into its own network so it cannot see other containers by default. 2023-03-17 12:17:01 -04:00			`user: nobody`
			`read_only: true`
			`security_opt:`
			`- no-new-privileges:true`
			`cap_drop:`
			`- ALL`
			`networks:`
Libreddit -> Redlib 2023-12-26 18:25:52 -05:00			`- redlib`
Add seccomp (merge 441) 2023-12-26 15:46:20 -05:00			`security_opt:`
Libreddit -> Redlib 2023-12-26 18:25:52 -05:00			`- seccomp="seccomp-redlib.json"`
Example docker-compose 2021-03-31 13:03:18 -07:00			`healthcheck:`
Change healthcheck script to utilise "wget" (#309) * Change healthcheck script to utilise "wget" * add "tries=1" option 2021-11-11 00:47:13 +00:00			`test: ["CMD", "wget", "--spider", "-q", "--tries=1", "http://localhost:8080/settings"]`
Example docker-compose 2021-03-31 13:03:18 -07:00			`interval: 5m`
Change healthcheck script to utilise "wget" (#309) * Change healthcheck script to utilise "wget" * add "tries=1" option 2021-11-11 00:47:13 +00:00			`timeout: 3s`
harden docker-compose.yml (#760) `user: nobody`: the least privileged account. `read_only: true`: this container doesn't write anything to the filesystem, this removes a vector. `security_opt`: disallows the container to grab more privileges. `cap_drop`: this container doesn't need any capabilities, drop them. `networks`: put `libreddit` into its own network so it cannot see other containers by default. 2023-03-17 12:17:01 -04:00
			`networks:`
Libreddit -> Redlib 2023-12-26 18:25:52 -05:00			`redlib:`