harden docker-compose.yml

docker-compose.yml

@@ -1,5 +1,6 @@
 version: "3.9"
 services:
+
   web:
     image: ghcr.io/metastem/wikiless:latest
     environment:
@@ -9,5 +10,28 @@ services:
       REDIS_URL: redis://redis
     ports:
       - 8080:8080
+    user: 65534:65534
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    networks:
+      - wikiless
+
   redis:
     image: "redis:alpine"
+    container_name: redis
+    user: nobody
+    read_only: true
+    tmpfs:
+      - /data:size=10M,mode=0770,uid=65534,gid=65534,noexec,nosuid,nodev
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    networks:
+      - wikiless
+
+networks:
+  wikiless: