fix: harden container privileges

backrest/compose.yaml

@@ -20,6 +20,18 @@ services:
     networks:
       - proxy
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    # Root keeps only the capabilities restic needs to read and restore
+    # files owned by other users.
+    cap_drop:
+      - ALL
+    cap_add:
+      - CHOWN
+      - DAC_OVERRIDE
+      - DAC_READ_SEARCH
+      - FOWNER
+      - FSETID
     deploy:
       resources:
         limits: