style: reorder service keys per dclint

adguardhome/compose.yaml

@@ -13,8 +13,6 @@ services:
     networks:
       - proxy
     restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
     deploy:
       resources:
         limits:
@@ -23,6 +21,8 @@ services:
         reservations:
           cpus: "0.2"
           memory: 128M
+    security_opt:
+      - no-new-privileges:true
 networks:
   proxy:
     external: true

backrest/compose.yaml

@@ -20,18 +20,16 @@ services:
     networks:
       - proxy
     restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
-    # Root keeps only the capabilities restic needs to read and restore
-    # files owned by other users.
-    cap_drop:
-      - ALL
     cap_add:
       - CHOWN
       - DAC_OVERRIDE
       - DAC_READ_SEARCH
       - FOWNER
       - FSETID
+    # Root keeps only the capabilities restic needs to read and restore
+    # files owned by other users.
+    cap_drop:
+      - ALL
     deploy:
       resources:
         limits:
@@ -40,6 +38,8 @@ services:
         reservations:
           cpus: "1.0"
           memory: 512M
+    security_opt:
+      - no-new-privileges:true
 networks:
   proxy:
     external: true

ddns-go/compose.yaml

@@ -7,8 +7,6 @@ services:
       - /srv/data/ddns-go:/root
     network_mode: host
     restart: always
-    security_opt:
-      - no-new-privileges:true
     deploy:
       resources:
         limits:
@@ -17,3 +15,5 @@ services:
         reservations:
           cpus: "0.1"
           memory: 16M
+    security_opt:
+      - no-new-privileges:true

gitea/compose.yaml

@@ -13,13 +13,13 @@ services:
     networks:
       - proxy
     restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
     deploy:
       resources:
         limits:
           cpus: "1.0"
           memory: 512M
+    security_opt:
+      - no-new-privileges:true
 networks:
   proxy:
     external: true

homeassistant/compose.yaml

@@ -11,8 +11,6 @@ services:
       TZ: Asia/Shanghai
     network_mode: host
     restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
     deploy:
       resources:
         limits:
@@ -21,4 +19,6 @@ services:
         reservations:
           cpus: "0.2"
           memory: 512M
+    security_opt:
+      - no-new-privileges:true
     stop_grace_period: 60s

immich/compose.yaml

@@ -21,8 +21,6 @@ services:
       - default
       - proxy
     restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
     healthcheck:
       disable: false
     deploy:
@@ -35,6 +33,8 @@ services:
           memory: 512M
     devices:
       - /dev/dri:/dev/dri
+    security_opt:
+      - no-new-privileges:true
   immich-machine-learning:
     image: ghcr.io/immich-app/immich-machine-learning:${IMMICH_VERSION:-release}
     container_name: immich-machine-learning
@@ -43,17 +43,17 @@ services:
     env_file:
       - .env
     restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
-    cap_drop:
-      - ALL
     healthcheck:
       disable: false
+    cap_drop:
+      - ALL
     deploy:
       resources:
         limits:
           cpus: "2.0"
           memory: 4G
+    security_opt:
+      - no-new-privileges:true
   database:
     image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
     container_name: immich-postgres
@@ -67,8 +67,6 @@ services:
     ports:
       - "127.0.0.1:5432:5432"
     restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
     healthcheck:
       disable: false
     deploy:
@@ -79,22 +77,22 @@ services:
         reservations:
           cpus: "0.2"
           memory: 128M
+    security_opt:
+      - no-new-privileges:true
     shm_size: 128mb
   redis:
     image: docker.io/valkey/valkey:9@sha256:c123e3715db63d06d4ad6964884037aa0d5d4d703939b9929954112889708e1d
     container_name: immich-redis
     restart: unless-stopped
-    security_opt:
+    healthcheck:
-      - no-new-privileges:true
+      test: redis-cli ping || exit 1
-    # The official image starts as root and drops to the valkey user.
-    cap_drop:
-      - ALL
     cap_add:
       - CHOWN
       - SETGID
       - SETUID
-    healthcheck:
+    # The official image starts as root and drops to the valkey user.
-      test: redis-cli ping || exit 1
+    cap_drop:
+      - ALL
     deploy:
       resources:
         limits:
@@ -103,6 +101,8 @@ services:
         reservations:
           cpus: "0.1"
           memory: 64M
+    security_opt:
+      - no-new-privileges:true
 networks:
   proxy:
     external: true

nginx/compose.yaml

@@ -24,8 +24,6 @@ services:
     extra_hosts:
       - "host.internal:172.31.255.1"
     restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
     deploy:
       resources:
         limits:
@@ -34,6 +32,8 @@ services:
         reservations:
           cpus: "0.05"
           memory: 16M
+    security_opt:
+      - no-new-privileges:true
   acme-sh:
     image: neilpang/acme.sh:3.1.4
     container_name: acme.sh
@@ -46,8 +46,6 @@ services:
       CF_Zone_ID: ${CF_ZONE_ID}
     command: daemon
     restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
     deploy:
       resources:
         limits:
@@ -56,6 +54,8 @@ services:
         reservations:
           cpus: "0.05"
           memory: 16M
+    security_opt:
+      - no-new-privileges:true
 networks:
   proxy:
     name: proxy

openlist/compose.yaml

@@ -13,11 +13,9 @@ services:
     networks:
       - proxy
     restart: unless-stopped
-    security_opt:
+    user: 1000:1000
-      - no-new-privileges:true
     cap_drop:
       - ALL
-    user: 1000:1000
     deploy:
       resources:
         limits:
@@ -26,6 +24,8 @@ services:
         reservations:
           cpus: "0.2"
           memory: 64M
+    security_opt:
+      - no-new-privileges:true
 networks:
   proxy:
     external: true

qbittorrent/compose.yaml

@@ -19,13 +19,13 @@ services:
     networks:
       - proxy
     restart: unless-stopped
-    security_opt:
-      - no-new-privileges:true
     deploy:
       resources:
         limits:
           cpus: "1.0"
           memory: 2G
+    security_opt:
+      - no-new-privileges:true
 networks:
   proxy:
     external: true

samba/compose.yaml

@@ -13,8 +13,6 @@ services:
     ports:
       - "192.168.10.101:445:445"
     restart: always
-    security_opt:
-      - no-new-privileges:true
     deploy:
       resources:
         limits:
@@ -23,3 +21,5 @@ services:
         reservations:
           cpus: "0.2"
           memory: 128M
+    security_opt:
+      - no-new-privileges:true