Skip to content

Security/caps selinux #144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MenomDE wants to merge 20 commits into
base: main
Choose a base branch
from
Open

Security/caps selinux #144

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
3335f37
security(traefikdashboard): add caps
MenomDE Jul 28, 2026
1428ab0
security(archiv): caps
MenomDE Jul 28, 2026
954378f
security(a3s): caps
MenomDE Jul 28, 2026
5f66bb6
security(asm): caps
MenomDE Jul 28, 2026
eb4bcaa
security(authentik): caps
MenomDE Jul 28, 2026
db25af9
security(beszel): caps
MenomDE Jul 28, 2026
8d5ccb8
security(dbeaver): caps
MenomDE Jul 28, 2026
6dd887f
security(coredns): caps, fix ?error
MenomDE Jul 28, 2026
f065563
security(grafana): caps
MenomDE Jul 28, 2026
c32eb03
security(fixmetrics): caps
MenomDE Jul 28, 2026
6e6b2e9
security(komodo): caps
MenomDE Jul 28, 2026
e178af3
security(kopia): caps, command -> env, remove disable-csrf
MenomDE Jul 28, 2026
4e07f03
security(website): caps, selinux
MenomDE Jul 28, 2026
69e380a
security(matomo): caps
MenomDE Jul 28, 2026
7072b0a
security(missions): caps
MenomDE Jul 28, 2026
a197a43
security(nextcloud): caps, condition
MenomDE Jul 28, 2026
8351592
security(ocap): caps
MenomDE Jul 28, 2026
704b214
security(steamoidc): caps
MenomDE Jul 28, 2026
151a2c7
security(traefik): caps, openport 8090 dashboard, api insecure false
MenomDE Jul 28, 2026
6717a3b
security(bot-nachrichtenoffizier): caps
MenomDE Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions docker/archiv/compose.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,12 @@ services:
restart: "unless-stopped"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
cap_add:
- "CHOWN"
- "SETUID"
- "SETGID"
environment:
TZ: "Europe/Berlin"
networks:
Expand All @@ -28,6 +34,13 @@ services:
restart: "unless-stopped"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
cap_add:
- "CHOWN"
- "SETUID"
- "SETGID"
- "DAC_OVERRIDE"
environment:
MARIADB_AUTO_UPGRADE: "1"
MARIADB_DISABLE_UPGRADE_BACKUP: "1"
Expand All @@ -53,6 +66,14 @@ services:
restart: "unless-stopped"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
cap_add:
- "CHOWN"
- "SETUID"
- "SETGID"
- "FOWNER"
- "DAC_OVERRIDE"
volumes:
- "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/db-backups:/backup:z"
environment:
Expand Down
4 changes: 4 additions & 0 deletions docker/arma3sync-repo/compose.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ services:
restart: "unless-stopped"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
cap_add:
- "NET_BIND_SERVICE"
volumes:
- "arma3sync-repo:/srv:ro"
- "./browse.html:/templates/browse.html:ro,Z"
Expand Down
15 changes: 15 additions & 0 deletions docker/armaservermanager/compose.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,13 @@ services:
restart: "unless-stopped"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
cap_add:
- "CHOWN"
- "SETUID"
- "SETGID"
- "DAC_OVERRIDE"
ports:
- "3306:3306"
environment:
Expand All @@ -30,6 +37,14 @@ services:
restart: "unless-stopped"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
cap_add:
- "CHOWN"
- "SETUID"
- "SETGID"
- "FOWNER"
- "DAC_OVERRIDE"
volumes:
- "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/db-backups:/backup:z"
environment:
Expand Down
32 changes: 31 additions & 1 deletion docker/authentik/compose.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,13 @@ services:
restart: "unless-stopped"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
cap_add:
- "CHOWN"
- "FOWNER"
- "SETUID"
- "SETGID"
depends_on:
db:
condition: "service_healthy"
Expand Down Expand Up @@ -51,12 +58,19 @@ services:
container_name: "${COMPOSE_PROJECT_NAME:?error}-worker"
command: "worker"
restart: "unless-stopped"
user: "root"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
cap_add:
- "CHOWN"
- "FOWNER"
- "SETUID"
- "SETGID"
depends_on:
db:
condition: "service_healthy"
user: "root"
volumes:
- "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/data:/data:z"
- "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/templates:/templates:z"
Expand All @@ -83,6 +97,14 @@ services:
restart: "unless-stopped"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
cap_add:
- "CHOWN"
- "SETUID"
- "SETGID"
- "FOWNER"
- "DAC_OVERRIDE"
healthcheck:
interval: "30s"
retries: 5
Expand All @@ -105,6 +127,14 @@ services:
restart: "unless-stopped"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
cap_add:
- "CHOWN"
- "SETUID"
- "SETGID"
- "FOWNER"
- "DAC_OVERRIDE"
volumes:
- "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/db-backups:/backup:z"
environment:
Expand Down
2 changes: 2 additions & 0 deletions docker/beszel/compose.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@ services:
restart: unless-stopped
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
environment:
TZ: "${TZ:-Europe/Berlin}"
USER_CREATION: "true"
Expand Down
8 changes: 8 additions & 0 deletions docker/bot-nachrichtenoffizier/compose.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,14 @@ services:
restart: "unless-stopped"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
cap_add:
- "CHOWN"
- "SETUID"
- "SETGID"
- "FOWNER"
- "DAC_OVERRIDE"
environment:
DISCORD_TOKEN: "${DISCORD_TOKEN:?error}"
CLIENT_ID: "${CLIENT_ID:?error}"
Expand Down
8 changes: 8 additions & 0 deletions docker/cloudbeaver/compose.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,14 @@ services:
restart: "unless-stopped"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
cap_add:
- "CHOWN"
- "SETUID"
- "SETGID"
- "FOWNER"
- "DAC_OVERRIDE"
environment:
TZ: "Europe/Berlin"
networks:
Expand Down
42 changes: 23 additions & 19 deletions docker/coredns/compose.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ services:
command: "-conf /etc/coredns/Corefile -dns.port 53"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
cap_add:
- "NET_BIND_SERVICE"
ports:
- "${IPV4:?error}:53:53"
- "${IPV4:?error}:53:53/udp"
Expand All @@ -18,37 +22,37 @@ services:
configs:
corefile:
content: |
${DOMAINNAME?error} {
${DOMAINNAME:?error} {
log
errors

hosts {
${IPV4:?error} backup.${DOMAINNAME?error}
${IPV6:?error} backup.${DOMAINNAME?error}
${IPV4:?error} backup.${DOMAINNAME:?error}
${IPV6:?error} backup.${DOMAINNAME:?error}

${IPV4:?error} komodo.${DOMAINNAME?error}
${IPV6:?error} komodo.${DOMAINNAME?error}
${IPV4:?error} komodo.${DOMAINNAME:?error}
${IPV6:?error} komodo.${DOMAINNAME:?error}

${IPV4:?error} docker0.${DOMAINNAME?error}
${IPV6:?error} docker0.${DOMAINNAME?error}
${IPV4:?error} docker0.${DOMAINNAME:?error}
${IPV6:?error} docker0.${DOMAINNAME:?error}

${IPV4:?error} traefik.${DOMAINNAME?error}
${IPV6:?error} traefik.${DOMAINNAME?error}
${IPV4:?error} traefik.${DOMAINNAME:?error}
${IPV6:?error} traefik.${DOMAINNAME:?error}

${IPV4:?error} traefik-log-dashboard.${DOMAINNAME?error}
${IPV6:?error} traefik-log-dashboard.${DOMAINNAME?error}
${IPV4:?error} traefik-log-dashboard.${DOMAINNAME:?error}
${IPV6:?error} traefik-log-dashboard.${DOMAINNAME:?error}

${IPV4:?error} beszel.${DOMAINNAME?error}
${IPV6:?error} beszel.${DOMAINNAME?error}
${IPV4:?error} beszel.${DOMAINNAME:?error}
${IPV6:?error} beszel.${DOMAINNAME:?error}

${IPV4:?error} ifxmetrics.${DOMAINNAME?error}
${IPV6:?error} ifxmetrics.${DOMAINNAME?error}
${IPV4:?error} ifxmetrics.${DOMAINNAME:?error}
${IPV6:?error} ifxmetrics.${DOMAINNAME:?error}

${IPV4:?error} asm.${DOMAINNAME?error}
${IPV6:?error} asm.${DOMAINNAME?error}
${IPV4:?error} asm.${DOMAINNAME:?error}
${IPV6:?error} asm.${DOMAINNAME:?error}

${IPV4:?error} dbs.${DOMAINNAME?error}
${IPV6:?error} dbs.${DOMAINNAME?error}
${IPV4:?error} dbs.${DOMAINNAME:?error}
${IPV6:?error} dbs.${DOMAINNAME:?error}

fallthrough
}
Expand Down
18 changes: 18 additions & 0 deletions docker/grafana/compose.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@ services:
restart: "unless-stopped"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
depends_on:
db:
condition: "service_healthy"
Expand Down Expand Up @@ -35,6 +37,14 @@ services:
restart: "unless-stopped"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
cap_add:
- "CHOWN"
- "SETUID"
- "SETGID"
- "FOWNER"
- "DAC_OVERRIDE"
healthcheck:
interval: "30s"
retries: 5
Expand All @@ -57,6 +67,14 @@ services:
restart: "unless-stopped"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
cap_add:
- "CHOWN"
- "SETUID"
- "SETGID"
- "FOWNER"
- "DAC_OVERRIDE"
volumes:
- "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/db-backups:/backup:z"
environment:
Expand Down
8 changes: 8 additions & 0 deletions docker/ifxmetrics/compose.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,14 @@ services:
restart: "unless-stopped"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
cap_add:
- "CHOWN"
- "SETUID"
- "SETGID"
- "FOWNER"
- "DAC_OVERRIDE"
ports:
- "8086:8086"
networks:
Expand Down
9 changes: 9 additions & 0 deletions docker/komodo/compose.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,13 @@ services:
restart: "unless-stopped"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
cap_add:
- "CHOWN"
- "SETUID"
- "SETGID"
- "DAC_OVERRIDE"
volumes:
- "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/mongo-data:/data/db:z"
- "${DOCKER_DATA_DIR:?error}/${COMPOSE_PROJECT_NAME:?error}/mongo-config:/data/configdb:z"
Expand All @@ -33,6 +40,8 @@ services:
restart: "unless-stopped"
security_opt:
- "no-new-privileges:true"
cap_drop:
- "ALL"
depends_on:
- "mongo"
ports:
Expand Down
9 changes: 6 additions & 3 deletions docker/kopia/compose.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,16 +8,19 @@ services:
security_opt:
- "label:disable" # Disable SELinux labels for compatibility with Kopia
- "no-new-privileges:true"
cap_drop:
- "ALL"
cap_add:
- "DAC_READ_SEARCH"
command:
- "server"
- "start"
- "--disable-csrf-token-checks"
- "--insecure"
- "--address=0.0.0.0:51515"
- "--server-username=${SERVER_USERNAME?error}"
- "--server-password=${SERVER_PASSWORD?error}"
environment:
KOPIA_PASSWORD: "${REPOSITORY_PASSWORD:?error}"
KOPIA_SERVER_USERNAME: "${SERVER_USERNAME:?error}"

@TheConen TheConen Jul 28, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Diese Variablen sind in der Kopia Doku nicht erwähnt. https://kopia.io/docs/installation/#docker-images

@MenomDE MenomDE Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nein, das richtig. Aber vorhanden, nutze es so bei mir:

https://github.com/search?q=repo%3Akopia%2Fkopia+Envar

Da findest du die mit der Suche

KOPIA_SERVER_PASSWORD: "${SERVER_PASSWORD:?error}"
USER: "${USER:-kopia}"
TZ: "Europe/Berlin"
networks:
Expand Down
Loading