docker-hardening #5

Merged

elirtf merged 3 commits from docker-hardening into master

2026-05-26 15:18:12 +00:00

elirtf commented

2026-05-26 15:18:08 +00:00

Owner

No description provided.

elirtf added 3 commits

2026-05-26 15:18:09 +00:00

fix(infra): harden Docker security, fix capability crash-loops, add entrypoint privilege drop 4ad9b168bd

- Add x-service-defaults YAML anchor with cap_drop: [ALL] + cap_add for
  all Python services (CHOWN, FOWNER, SETUID, SETGID, DAC_OVERRIDE)
- Fix nginx crash-loop: explicitly list all needed capabilities so
  YAML <<: merge doesn't replace them (was missing SETUID/SETGID)
- Fix go2rtc crash-loop: override cap_drop/cap_add to empty so
  third-party image gets Docker defaults
- Add DAC_OVERRIDE to capability set (root needs it to write to
  named volumes owned by opus user in the entrypoint)
- Compile su-exec from source in Dockerfile, drop privileges via
  entrypoint (no more USER opus in Dockerfile)
- Rewrite docker-entrypoint-opus.sh: chown volumes → UI copy → su-exec
- Add healthcheck DB ping in /healthz (SELECT 1) instead of trivial 200
- Increase busy_timeout 5000→10000 for 3 concurrent SQLite services
- Add shm_size, log rotation, stop_grace_period, localtime mounts,
  commented GPU passthrough sections
- Pin go2rtc to alexxit/go2rtc:1.9.14
- Clean up .dockerignore

feat(infra): add compose override files for debug, monitoring, and backup b2c4a36462

- docker-compose.debug.yml: hot-reload, verbose logs, debugpy port
- docker-compose.monitoring.yml: Prometheus + Grafana behind profile
- monitoring/: Prometheus scrape config, auto-provisioned Grafana
- scripts/backup.sh: SQLite dump + config archive helper
- app/__init__.py: add PrometheusMetrics (/metrics on all services)
- requirements.txt: add prometheus_flask_exporter
- docs/DEV_WORKFLOW.md: document all override files and usage
- Makefile: up-debug, up-monitoring targets
- docker-compose.yml: remove GPU comment blocks (deferred past v1.0)

perf(dockerfile): enable BuildKit cache mounts, COPY --link, HEALTHCHECK, and shell hardening 5fa3a3e054

- Add syntax=docker/dockerfile:1 for BuildKit features
- Add ARG DEBIAN_FRONTEND=noninteractive and SHELL pipefail
- Use --mount=type=cache for pip (caches downloads across rebuilds)
- Use COPY --link for independent layer caching
- Merge groupadd + mkdir into single RUN layer
- Add HEALTHCHECK instruction for standalone image portability

elirtf merged commit 5fa3a3e054 into master

2026-05-26 15:18:12 +00:00

elirtf deleted branch docker-hardening

2026-05-26 15:18:12 +00:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

elirtf/opus!5

No description provided.

Rows
Columns