fix: harden container privileges

nginx/compose.yaml

@@ -24,6 +24,8 @@ services:
     extra_hosts:
       - "host.internal:172.31.255.1"
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     deploy:
       resources:
         limits:
@@ -44,6 +46,8 @@ services:
       CF_Zone_ID: ${CF_ZONE_ID}
     command: daemon
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     deploy:
       resources:
         limits: