From 09dbbe46b74f9b12ab9c8cf979dad4c4f0e4875f Mon Sep 17 00:00:00 2001 From: Haletran Date: Tue, 3 Mar 2026 16:03:12 +0100 Subject: [PATCH] feat: readonly and use of tmpfs for some containers --- core/caddy/compose.yml | 7 +++++++ core/caddy/config/sites/outils.caddy | 1 + core/doh/compose.yml | 6 ++++++ core/git/compose.yml | 8 ++++++++ core/keycloak/compose.yml | 2 ++ core/nextcloud/compose.yml | 13 +++++++++++++ core/peertube/compose.yml | 13 +++++++++++++ core/postgresql/compose.yml | 6 ++++++ core/tools/docker-security.sh | 5 +++++ startup | 20 +++++++++++--------- 10 files changed, 72 insertions(+), 9 deletions(-) create mode 100644 core/tools/docker-security.sh diff --git a/core/caddy/compose.yml b/core/caddy/compose.yml index add6e68..4fa337c 100644 --- a/core/caddy/compose.yml +++ b/core/caddy/compose.yml @@ -5,6 +5,12 @@ services: ports: - "80:80" - "443:443" + read_only: true + security_opt: + - no-new-privileges:true + tmpfs: + - /tmp + - /run volumes: - caddy-caddyfiles:/etc/caddy - caddy-data:/data @@ -14,6 +20,7 @@ services: networks: - proxy restart: unless-stopped + volumes: caddy-caddyfiles: diff --git a/core/caddy/config/sites/outils.caddy b/core/caddy/config/sites/outils.caddy index a1e7d2d..2e67095 100644 --- a/core/caddy/config/sites/outils.caddy +++ b/core/caddy/config/sites/outils.caddy @@ -47,6 +47,7 @@ outils.chatons.duckdns.org {