style: reorder service keys per dclint

immich/compose.yaml

@@ -21,8 +21,6 @@ services:
       - default
       - proxy
     restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
     healthcheck:
       disable: false
     deploy:
@@ -35,6 +33,8 @@ services:
           memory: 512M
     devices:
       - /dev/dri:/dev/dri
+    security_opt:
+      - no-new-privileges:true
   immich-machine-learning:
     image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
     container_name: immich-machine-learning
@@ -43,17 +43,17 @@ services:
     env_file:
       - .env
     restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
-    cap_drop:
-      - ALL
     healthcheck:
       disable: false
+    cap_drop:
+      - ALL
     deploy:
       resources:
         limits:
           cpus: "2.0"
           memory: 4G
+    security_opt:
+      - no-new-privileges:true
   database:
     image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
     container_name: immich-postgres
@@ -67,8 +67,6 @@ services:
     ports:
       - "127.0.0.1:5432:5432"
     restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
     healthcheck:
       disable: false
     deploy:
@@ -79,22 +77,22 @@ services:
         reservations:
           cpus: "0.2"
           memory: 128M
+    security_opt:
+      - no-new-privileges:true
     shm_size: 128mb
   redis:
     image: docker.io/valkey/valkey:9@sha256:c123e3715db63d06d4ad6964884037aa0d5d4d703939b9929954112889708e1d
     container_name: immich-redis
     restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
-    # The official image starts as root and drops to the valkey user.
-    cap_drop:
-      - ALL
+    healthcheck:
+      test: redis-cli ping || exit 1
     cap_add:
       - CHOWN
       - SETGID
       - SETUID
-    healthcheck:
-      test: redis-cli ping || exit 1
+    # The official image starts as root and drops to the valkey user.
+    cap_drop:
+      - ALL
     deploy:
       resources:
         limits:
@@ -103,6 +101,8 @@ services:
         reservations:
           cpus: "0.1"
           memory: 64M
+    security_opt:
+      - no-new-privileges:true
 networks:
   proxy:
     external: true