Comment

Comment on GitHub - SinTan1729/chhoto-url: A simple, blazingly fast, selfhosted URL shortener with no unnecessary features; written in Rust.

<- View Parent

glizzyguzzler@lemmy.blahaj.zone ⁨4⁩ ⁨weeks⁩ ago

I try to slap anything I’d face the Internet with with the read_only to further restrict exploit possibilities, would be abs great if you could make it work! I just follow all reqs on the security cheat sheet, with read_only being one of them: …owasp.org/…/Docker_Security_Cheat_Sheet.html

With how simple it is I guessed that running as a user and restricting cap_drop: all wouldn’t be a problem.

For read_only many containers just need tmpfs: /tmp in addition to the volume for the db. I think many containers just try to contain temporary file writing to one directory to make applying read_only easier.

So again, I’d abs use it with read_only when you get the time to tune it!!

source

Sort:hotnew top

SinTan1729@programming.dev ⁨4⁩ ⁨weeks⁩ ago
On further testing, this does actually work. You may set both read_only: true, and cap_drop: all and it will work as long as you have a named volume. I had it mount a database file from the host system for my test config, which is why I was getting the errors. I don’t know how to make that work though i.e. when the db is bind mounted from the host system. Setting the mount :rw doesn’t seem to fix it.

source
- glizzyguzzler@lemmy.blahaj.zone ⁨3⁩ ⁨weeks⁩ ago
  Odd, I’ll try to deploy this when I can and see!
  
  I’ve never had a problem with a volume being on the host system, except with user permissions messed up. But if you haven’t given it a user parameter it’s running as root and shouldn’t have a problem. So I’ll see sometime and get back to you!
  
  source