From dc64f0627343c795019dabfbb49494b426d8d8f3 Mon Sep 17 00:00:00 2001 From: lingkai5wu Date: Fri, 16 Oct 2026 15:45:21 +0800 Subject: [PATCH] style: reorder service keys per dclint --- adguardhome/compose.yaml | 4 ++-- backrest/compose.yaml | 12 ++++++------ ddns-go/compose.yaml | 4 ++-- gitea/compose.yaml | 4 ++-- homeassistant/compose.yaml | 4 ++-- immich/compose.yaml | 30 +++++++++++++++--------------- nginx/compose.yaml | 8 ++++---- openlist/compose.yaml | 6 +++--- qbittorrent/compose.yaml | 4 ++-- samba/compose.yaml | 4 ++-- 10 files changed, 40 insertions(+), 40 deletions(-) diff --git a/adguardhome/compose.yaml b/adguardhome/compose.yaml index b398960..b14ceac 100644 --- a/adguardhome/compose.yaml +++ b/adguardhome/compose.yaml @@ -13,8 +13,6 @@ services: networks: - proxy restart: unless-stopped - security_opt: - - no-new-privileges:true deploy: resources: limits: @@ -23,6 +21,8 @@ services: reservations: cpus: "0.2" memory: 128M + security_opt: + - no-new-privileges:true networks: proxy: external: true diff --git a/backrest/compose.yaml b/backrest/compose.yaml index d5b3d48..93d4e44 100644 --- a/backrest/compose.yaml +++ b/backrest/compose.yaml @@ -20,18 +20,16 @@ services: networks: - proxy restart: unless-stopped - security_opt: - - no-new-privileges:true - # Root keeps only the capabilities restic needs to read and restore - # files owned by other users. - cap_drop: - - ALL cap_add: - CHOWN - DAC_OVERRIDE - DAC_READ_SEARCH - FOWNER - FSETID + # Root keeps only the capabilities restic needs to read and restore + # files owned by other users. + cap_drop: + - ALL deploy: resources: limits: @@ -40,6 +38,8 @@ services: reservations: cpus: "1.0" memory: 512M + security_opt: + - no-new-privileges:true networks: proxy: external: true diff --git a/ddns-go/compose.yaml b/ddns-go/compose.yaml index 607f98e..3520a9f 100644 --- a/ddns-go/compose.yaml +++ b/ddns-go/compose.yaml @@ -7,8 +7,6 @@ services: - /srv/data/ddns-go:/root network_mode: host restart: always - security_opt: - - no-new-privileges:true deploy: resources: limits: @@ -17,3 +15,5 @@ services: reservations: cpus: "0.1" memory: 16M + security_opt: + - no-new-privileges:true diff --git a/gitea/compose.yaml b/gitea/compose.yaml index 99b89dd..fa56ce9 100644 --- a/gitea/compose.yaml +++ b/gitea/compose.yaml @@ -13,13 +13,13 @@ services: networks: - proxy restart: unless-stopped - security_opt: - - no-new-privileges:true deploy: resources: limits: cpus: "1.0" memory: 512M + security_opt: + - no-new-privileges:true networks: proxy: external: true diff --git a/homeassistant/compose.yaml b/homeassistant/compose.yaml index ce8ebf1..89167c6 100644 --- a/homeassistant/compose.yaml +++ b/homeassistant/compose.yaml @@ -11,8 +11,6 @@ services: TZ: Asia/Shanghai network_mode: host restart: unless-stopped - security_opt: - - no-new-privileges:true deploy: resources: limits: @@ -21,4 +19,6 @@ services: reservations: cpus: "0.2" memory: 512M + security_opt: + - no-new-privileges:true stop_grace_period: 60s diff --git a/immich/compose.yaml b/immich/compose.yaml index 870c811..f42a2df 100644 --- a/immich/compose.yaml +++ b/immich/compose.yaml @@ -21,8 +21,6 @@ services: - default - proxy restart: unless-stopped - security_opt: - - no-new-privileges:true healthcheck: disable: false deploy: @@ -35,6 +33,8 @@ services: memory: 512M devices: - /dev/dri:/dev/dri + security_opt: + - no-new-privileges:true immich-machine-learning: image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release} container_name: immich-machine-learning @@ -43,17 +43,17 @@ services: env_file: - .env restart: unless-stopped - security_opt: - - no-new-privileges:true - cap_drop: - - ALL healthcheck: disable: false + cap_drop: + - ALL deploy: resources: limits: cpus: "2.0" memory: 4G + security_opt: + - no-new-privileges:true database: image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23 container_name: immich-postgres @@ -67,8 +67,6 @@ services: ports: - "127.0.0.1:5432:5432" restart: unless-stopped - security_opt: - - no-new-privileges:true healthcheck: disable: false deploy: @@ -79,22 +77,22 @@ services: reservations: cpus: "0.2" memory: 128M + security_opt: + - no-new-privileges:true shm_size: 128mb redis: image: docker.io/valkey/valkey:9@sha256:c123e3715db63d06d4ad6964884037aa0d5d4d703939b9929954112889708e1d container_name: immich-redis restart: unless-stopped - security_opt: - - no-new-privileges:true - # The official image starts as root and drops to the valkey user. - cap_drop: - - ALL + healthcheck: + test: redis-cli ping || exit 1 cap_add: - CHOWN - SETGID - SETUID - healthcheck: - test: redis-cli ping || exit 1 + # The official image starts as root and drops to the valkey user. + cap_drop: + - ALL deploy: resources: limits: @@ -103,6 +101,8 @@ services: reservations: cpus: "0.1" memory: 64M + security_opt: + - no-new-privileges:true networks: proxy: external: true diff --git a/nginx/compose.yaml b/nginx/compose.yaml index 495bfd5..61dd63a 100644 --- a/nginx/compose.yaml +++ b/nginx/compose.yaml @@ -24,8 +24,6 @@ services: extra_hosts: - "host.internal:172.31.255.1" restart: unless-stopped - security_opt: - - no-new-privileges:true deploy: resources: limits: @@ -34,6 +32,8 @@ services: reservations: cpus: "0.05" memory: 16M + security_opt: + - no-new-privileges:true acme-sh: image: neilpang/acme.sh:3.1.4 container_name: acme.sh @@ -46,8 +46,6 @@ services: CF_Zone_ID: ${CF_ZONE_ID} command: daemon restart: unless-stopped - security_opt: - - no-new-privileges:true deploy: resources: limits: @@ -56,6 +54,8 @@ services: reservations: cpus: "0.05" memory: 16M + security_opt: + - no-new-privileges:true networks: proxy: name: proxy diff --git a/openlist/compose.yaml b/openlist/compose.yaml index 13fdb57..fc42d71 100644 --- a/openlist/compose.yaml +++ b/openlist/compose.yaml @@ -13,11 +13,9 @@ services: networks: - proxy restart: unless-stopped - security_opt: - - no-new-privileges:true + user: 1000:1000 cap_drop: - ALL - user: 1000:1000 deploy: resources: limits: @@ -26,6 +24,8 @@ services: reservations: cpus: "0.2" memory: 64M + security_opt: + - no-new-privileges:true networks: proxy: external: true diff --git a/qbittorrent/compose.yaml b/qbittorrent/compose.yaml index 53e76a4..dbcf13a 100644 --- a/qbittorrent/compose.yaml +++ b/qbittorrent/compose.yaml @@ -19,13 +19,13 @@ services: networks: - proxy restart: unless-stopped - security_opt: - - no-new-privileges:true deploy: resources: limits: cpus: "1.0" memory: 2G + security_opt: + - no-new-privileges:true networks: proxy: external: true diff --git a/samba/compose.yaml b/samba/compose.yaml index a646674..d89a8c5 100644 --- a/samba/compose.yaml +++ b/samba/compose.yaml @@ -13,8 +13,6 @@ services: ports: - "192.168.10.101:445:445" restart: always - security_opt: - - no-new-privileges:true deploy: resources: limits: @@ -23,3 +21,5 @@ services: reservations: cpus: "0.2" memory: 128M + security_opt: + - no-new-privileges:true