From 6e02bd39ae5bbf5ed7f5e27d06ded770382e19b2 Mon Sep 17 00:00:00 2001
From: lingkai5wu <lingkai5wu@outlook.com>
Date: Fri, 16 Oct 2026 15:11:17 +0800
Subject: [PATCH] fix: harden container privileges

---
 adguardhome/compose.yaml   |  2 ++
 backrest/compose.yaml      | 12 ++++++++++++
 capture.sh                 |  2 ++
 ddns-go/compose.yaml       |  2 ++
 gitea/compose.yaml         |  2 ++
 homeassistant/compose.yaml |  2 ++
 immich/compose.yaml        | 17 +++++++++++++++++
 nginx/compose.yaml         |  4 ++++
 openlist/compose.yaml      |  4 ++++
 qbittorrent/compose.yaml   |  2 ++
 samba/compose.yaml         |  2 ++
 11 files changed, 51 insertions(+)

diff --git a/adguardhome/compose.yaml b/adguardhome/compose.yaml
index 98dc57d..b398960 100644
--- a/adguardhome/compose.yaml
+++ b/adguardhome/compose.yaml
@@ -13,6 +13,8 @@ services:
     networks:
       - proxy
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     deploy:
       resources:
         limits:
diff --git a/backrest/compose.yaml b/backrest/compose.yaml
index bb6d98c..d5b3d48 100644
--- a/backrest/compose.yaml
+++ b/backrest/compose.yaml
@@ -20,6 +20,18 @@ services:
     networks:
       - proxy
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    # Root keeps only the capabilities restic needs to read and restore
+    # files owned by other users.
+    cap_drop:
+      - ALL
+    cap_add:
+      - CHOWN
+      - DAC_OVERRIDE
+      - DAC_READ_SEARCH
+      - FOWNER
+      - FSETID
     deploy:
       resources:
         limits:
diff --git a/capture.sh b/capture.sh
index 018d393..072e27e 100755
--- a/capture.sh
+++ b/capture.sh
@@ -68,6 +68,8 @@ docker_args=(
 	run
 	--rm
 	--network "container:$CONTAINER"
+	--cap-drop ALL
+	--security-opt no-new-privileges:true
 	--cap-add NET_RAW
 	--cap-add NET_ADMIN
 )
diff --git a/ddns-go/compose.yaml b/ddns-go/compose.yaml
index 5651b4e..607f98e 100644
--- a/ddns-go/compose.yaml
+++ b/ddns-go/compose.yaml
@@ -7,6 +7,8 @@ services:
       - /srv/data/ddns-go:/root
     network_mode: host
     restart: always
+    security_opt:
+      - no-new-privileges:true
     deploy:
       resources:
         limits:
diff --git a/gitea/compose.yaml b/gitea/compose.yaml
index 871869a..99b89dd 100644
--- a/gitea/compose.yaml
+++ b/gitea/compose.yaml
@@ -13,6 +13,8 @@ services:
     networks:
       - proxy
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     deploy:
       resources:
         limits:
diff --git a/homeassistant/compose.yaml b/homeassistant/compose.yaml
index 4904209..ce8ebf1 100644
--- a/homeassistant/compose.yaml
+++ b/homeassistant/compose.yaml
@@ -11,6 +11,8 @@ services:
       TZ: Asia/Shanghai
     network_mode: host
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     deploy:
       resources:
         limits:
diff --git a/immich/compose.yaml b/immich/compose.yaml
index d3e06ad..870c811 100644
--- a/immich/compose.yaml
+++ b/immich/compose.yaml
@@ -21,6 +21,8 @@ services:
       - default
       - proxy
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     healthcheck:
       disable: false
     deploy:
@@ -41,6 +43,10 @@ services:
     env_file:
       - .env
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
     healthcheck:
       disable: false
     deploy:
@@ -61,6 +67,8 @@ services:
     ports:
       - "127.0.0.1:5432:5432"
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     healthcheck:
       disable: false
     deploy:
@@ -76,6 +84,15 @@ services:
     image: docker.io/valkey/valkey:9@sha256:c123e3715db63d06d4ad6964884037aa0d5d4d703939b9929954112889708e1d
     container_name: immich-redis
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    # The official image starts as root and drops to the valkey user.
+    cap_drop:
+      - ALL
+    cap_add:
+      - CHOWN
+      - SETGID
+      - SETUID
     healthcheck:
       test: redis-cli ping || exit 1
     deploy:
diff --git a/nginx/compose.yaml b/nginx/compose.yaml
index c8afe6a..f0b3f8e 100644
--- a/nginx/compose.yaml
+++ b/nginx/compose.yaml
@@ -24,6 +24,8 @@ services:
     extra_hosts:
       - "host.internal:172.31.255.1"
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     deploy:
       resources:
         limits:
@@ -44,6 +46,8 @@ services:
       CF_Zone_ID: ${CF_ZONE_ID}
     command: daemon
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     deploy:
       resources:
         limits:
diff --git a/openlist/compose.yaml b/openlist/compose.yaml
index e2136a9..13fdb57 100644
--- a/openlist/compose.yaml
+++ b/openlist/compose.yaml
@@ -13,6 +13,10 @@ services:
     networks:
       - proxy
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
     user: 1000:1000
     deploy:
       resources:
diff --git a/qbittorrent/compose.yaml b/qbittorrent/compose.yaml
index b84dcfa..53e76a4 100644
--- a/qbittorrent/compose.yaml
+++ b/qbittorrent/compose.yaml
@@ -19,6 +19,8 @@ services:
     networks:
       - proxy
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     deploy:
       resources:
         limits:
diff --git a/samba/compose.yaml b/samba/compose.yaml
index 60e6531..a646674 100644
--- a/samba/compose.yaml
+++ b/samba/compose.yaml
@@ -13,6 +13,8 @@ services:
     ports:
       - "192.168.10.101:445:445"
     restart: always
+    security_opt:
+      - no-new-privileges:true
     deploy:
       resources:
         limits: