redlib/docker-compose.yml

version: "3.8"

services:
  web:
    build: .
    restart: always
    container_name: "libreddit"
    ports:
      - 8080:8080
    user: nobody
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    networks:
      - libreddit
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "--tries=1", "http://localhost:8080/settings"]
      interval: 5m
      timeout: 3s

networks:
  libreddit:
Example docker-compose 2021-03-31 13:03:18 -07:00			`version: "3.8"`

			`services:`
			`web:`
			`build: .`
			`restart: always`
			`container_name: "libreddit"`
			`ports:`
			`- 8080:8080`
harden docker-compose.yml (#760) `user: nobody`: the least privileged account. `read_only: true`: this container doesn't write anything to the filesystem, this removes a vector. `security_opt`: disallows the container to grab more privileges. `cap_drop`: this container doesn't need any capabilities, drop them. `networks`: put `libreddit` into its own network so it cannot see other containers by default. 2023-03-17 12:17:01 -04:00			`user: nobody`
			`read_only: true`
			`security_opt:`
			`- no-new-privileges:true`
			`cap_drop:`
			`- ALL`
			`networks:`
			`- libreddit`
Example docker-compose 2021-03-31 13:03:18 -07:00			`healthcheck:`
Change healthcheck script to utilise "wget" (#309) * Change healthcheck script to utilise "wget" * add "tries=1" option 2021-11-11 00:47:13 +00:00			`test: ["CMD", "wget", "--spider", "-q", "--tries=1", "http://localhost:8080/settings"]`
Example docker-compose 2021-03-31 13:03:18 -07:00			`interval: 5m`
Change healthcheck script to utilise "wget" (#309) * Change healthcheck script to utilise "wget" * add "tries=1" option 2021-11-11 00:47:13 +00:00			`timeout: 3s`
harden docker-compose.yml (#760) `user: nobody`: the least privileged account. `read_only: true`: this container doesn't write anything to the filesystem, this removes a vector. `security_opt`: disallows the container to grab more privileges. `cap_drop`: this container doesn't need any capabilities, drop them. `networks`: put `libreddit` into its own network so it cannot see other containers by default. 2023-03-17 12:17:01 -04:00
			`networks:`
			`libreddit:`