From e25622dac29b609f80770e3721ff4e11106cf0b5 Mon Sep 17 00:00:00 2001
From: kuanhulio <66286575+kuanhulio@users.noreply.github.com>
Date: Fri, 17 Mar 2023 12:17:01 -0400
Subject: [PATCH] harden docker-compose.yml (#760)

`user: nobody`: the least privileged account.
`read_only: true`: this container doesn't write anything to the filesystem, this removes a vector.
`security_opt`: disallows the container to grab more privileges.
`cap_drop`: this container doesn't need any capabilities, drop them.
`networks`: put `libreddit` into its own network so it cannot see other containers by default.
---
 docker-compose.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index 2688e9d..ad0fd1f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,7 +7,18 @@ services:
     container_name: "libreddit"
     ports:
       - 8080:8080
+    user: nobody
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    networks:
+      - libreddit
     healthcheck:
       test: ["CMD", "wget", "--spider", "-q", "--tries=1", "http://localhost:8080/settings"]
       interval: 5m
       timeout: 3s
+
+networks:
+  libreddit: