fix: harden container privileges

immich/compose.yaml

@@ -21,6 +21,8 @@ services:
       - default
       - proxy
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     healthcheck:
       disable: false
     deploy:
@@ -41,6 +43,10 @@ services:
     env_file:
       - .env
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
     healthcheck:
       disable: false
     deploy:
@@ -61,6 +67,8 @@ services:
     ports:
       - "127.0.0.1:5432:5432"
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     healthcheck:
       disable: false
     deploy:
@@ -76,6 +84,15 @@ services:
     image: docker.io/valkey/valkey:9@sha256:c123e3715db63d06d4ad6964884037aa0d5d4d703939b9929954112889708e1d
     container_name: immich-redis
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    # The official image starts as root and drops to the valkey user.
+    cap_drop:
+      - ALL
+    cap_add:
+      - CHOWN
+      - SETGID
+      - SETUID
     healthcheck:
       test: redis-cli ping || exit 1
     deploy: