fix: harden container privileges

adguardhome/compose.yaml

@@ -13,6 +13,8 @@ services:
     networks:
       - proxy
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     deploy:
       resources:
         limits:

backrest/compose.yaml

@@ -20,6 +20,18 @@ services:
     networks:
       - proxy
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    # Root keeps only the capabilities restic needs to read and restore
+    # files owned by other users.
+    cap_drop:
+      - ALL
+    cap_add:
+      - CHOWN
+      - DAC_OVERRIDE
+      - DAC_READ_SEARCH
+      - FOWNER
+      - FSETID
     deploy:
       resources:
         limits:

capture.sh

@@ -68,6 +68,8 @@ docker_args=(
 	run
 	--rm
 	--network "container:$CONTAINER"
+	--cap-drop ALL
+	--security-opt no-new-privileges:true
 	--cap-add NET_RAW
 	--cap-add NET_ADMIN
 )

ddns-go/compose.yaml

@@ -7,6 +7,8 @@ services:
       - /srv/data/ddns-go:/root
     network_mode: host
     restart: always
+    security_opt:
+      - no-new-privileges:true
     deploy:
       resources:
         limits:

gitea/compose.yaml

@@ -13,6 +13,8 @@ services:
     networks:
       - proxy
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     deploy:
       resources:
         limits:

homeassistant/compose.yaml

@@ -11,6 +11,8 @@ services:
       TZ: Asia/Shanghai
     network_mode: host
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     deploy:
       resources:
         limits:

immich/compose.yaml

@@ -21,6 +21,8 @@ services:
       - default
       - proxy
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     healthcheck:
       disable: false
     deploy:
@@ -41,6 +43,10 @@ services:
     env_file:
       - .env
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
     healthcheck:
       disable: false
     deploy:
@@ -61,6 +67,8 @@ services:
     ports:
       - "127.0.0.1:5432:5432"
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     healthcheck:
       disable: false
     deploy:
@@ -76,6 +84,15 @@ services:
     image: docker.io/valkey/valkey:9@sha256:c123e3715db63d06d4ad6964884037aa0d5d4d703939b9929954112889708e1d
     container_name: immich-redis
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    # The official image starts as root and drops to the valkey user.
+    cap_drop:
+      - ALL
+    cap_add:
+      - CHOWN
+      - SETGID
+      - SETUID
     healthcheck:
       test: redis-cli ping || exit 1
     deploy:

nginx/compose.yaml

@@ -24,6 +24,8 @@ services:
     extra_hosts:
       - "host.internal:172.31.255.1"
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     deploy:
       resources:
         limits:
@@ -44,6 +46,8 @@ services:
       CF_Zone_ID: ${CF_ZONE_ID}
     command: daemon
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     deploy:
       resources:
         limits:

openlist/compose.yaml

@@ -13,6 +13,10 @@ services:
     networks:
       - proxy
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
     user: 1000:1000
     deploy:
       resources:

qbittorrent/compose.yaml

@@ -19,6 +19,8 @@ services:
     networks:
       - proxy
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
     deploy:
       resources:
         limits:

samba/compose.yaml

@@ -13,6 +13,8 @@ services:
     ports:
       - "192.168.10.101:445:445"
     restart: always
+    security_opt:
+      - no-new-privileges:true
     deploy:
       resources:
         limits: