redsunlib/compose.yaml

services:
  web:
    image: quay.io/redlib/redlib
    # quay.io/redlib/redlib:latest-arm # uncomment if you use arm64
    # quay.io/redlib/redlib:latest-armv7 # uncomment if you use armv7
    restart: always
    container_name: "redlib"
    ports:
      - 8080:8080
    user: nobody
    read_only: true
    security_opt:
      - no-new-privileges:true
      - seccomp="seccomp-redlib.json"
    cap_drop:
      - ALL
    networks:
      - redlib
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "--tries=1", "http://localhost:8080/settings"]
      interval: 5m
      timeout: 3s

networks:
  redlib:
Example docker-compose 2021-04-01 09:03:18 +13:00			`services:`
			`web:`
use official image 2024-01-27 05:03:56 +13:00			`image: quay.io/redlib/redlib`
			`# quay.io/redlib/redlib:latest-arm # uncomment if you use arm64`
			`# quay.io/redlib/redlib:latest-armv7 # uncomment if you use armv7`
Example docker-compose 2021-04-01 09:03:18 +13:00			`restart: always`
Libreddit -> Redlib 2023-12-27 12:25:52 +13:00			`container_name: "redlib"`
Example docker-compose 2021-04-01 09:03:18 +13:00			`ports:`
			`- 8080:8080`
harden docker-compose.yml (#760) `user: nobody`: the least privileged account. `read_only: true`: this container doesn't write anything to the filesystem, this removes a vector. `security_opt`: disallows the container to grab more privileges. `cap_drop`: this container doesn't need any capabilities, drop them. `networks`: put `libreddit` into its own network so it cannot see other containers by default. 2023-03-18 05:17:01 +13:00			`user: nobody`
			`read_only: true`
			`security_opt:`
			`- no-new-privileges:true`
Update docker-compose.yml to remove duplicate 'security_opt' (#45) * Update docker-compose.yml to remove duplicate 'security_opt' Docker compose complains with "mapping key "security_opt" already defined" * Update and rename docker-compose.yml to compose.yaml `version:` is deprecated: https://docs.docker.com/compose/compose-file/04-version-and-name/ compose.yaml is the current standard: https://docs.docker.com/contribute/style/terminology/#composeyaml 2024-02-07 06:14:37 +13:00			`- seccomp="seccomp-redlib.json"`
harden docker-compose.yml (#760) `user: nobody`: the least privileged account. `read_only: true`: this container doesn't write anything to the filesystem, this removes a vector. `security_opt`: disallows the container to grab more privileges. `cap_drop`: this container doesn't need any capabilities, drop them. `networks`: put `libreddit` into its own network so it cannot see other containers by default. 2023-03-18 05:17:01 +13:00			`cap_drop:`
			`- ALL`
			`networks:`
Libreddit -> Redlib 2023-12-27 12:25:52 +13:00			`- redlib`
Example docker-compose 2021-04-01 09:03:18 +13:00			`healthcheck:`
Change healthcheck script to utilise "wget" (#309) * Change healthcheck script to utilise "wget" * add "tries=1" option 2021-11-11 13:47:13 +13:00			`test: ["CMD", "wget", "--spider", "-q", "--tries=1", "http://localhost:8080/settings"]`
Example docker-compose 2021-04-01 09:03:18 +13:00			`interval: 5m`
Change healthcheck script to utilise "wget" (#309) * Change healthcheck script to utilise "wget" * add "tries=1" option 2021-11-11 13:47:13 +13:00			`timeout: 3s`
harden docker-compose.yml (#760) `user: nobody`: the least privileged account. `read_only: true`: this container doesn't write anything to the filesystem, this removes a vector. `security_opt`: disallows the container to grab more privileges. `cap_drop`: this container doesn't need any capabilities, drop them. `networks`: put `libreddit` into its own network so it cannot see other containers by default. 2023-03-18 05:17:01 +13:00
			`networks:`
Libreddit -> Redlib 2023-12-27 12:25:52 +13:00			`redlib:`