mirror of
https://codeberg.org/video-prize-ranch/rimgo.git
synced 2025-06-27 15:38:23 +00:00
9b5af0aeb6
`user: nobody`: the least privileged account. `read_only: true`: this container doesn't write anything to the filesystem, this removes a vector. `security_opt`: disallows the container to grab more privileges. `cap_drop`: this container doesn't need any capabilities, drop them. `networks`: put `rimgo` into its own network so it cannot see other containers by default. Reviewed-on: https://codeberg.org/video-prize-ranch/rimgo/pulls/99 Co-authored-by: kuantum <kuantum@noreply.codeberg.org> Co-committed-by: kuantum <kuantum@noreply.codeberg.org>
21 lines
452 B
YAML
21 lines
452 B
YAML
version: '3'
|
|
|
|
services:
|
|
rimgo:
|
|
image: codeberg.org/video-prize-ranch/rimgo # Official image
|
|
#image: quay.io/pussthecatorg/rimgo # Unofficial image
|
|
#build: . # Uncomment to build from source
|
|
ports:
|
|
- 3000:3000
|
|
restart: unless-stopped
|
|
user: 65534:65534 # equivalent to `nobody`
|
|
read_only: true
|
|
security_opt:
|
|
- no-new-privileges: true
|
|
cap_drop:
|
|
- ALL
|
|
networks:
|
|
- rimgo
|
|
|
|
networks:
|
|
- rimgo |