From cf0bd3f0c25f33990ebab9be69baf20df89dc61a Mon Sep 17 00:00:00 2001 From: Mikhail Lobanov Date: Wed, 14 Oct 2026 22:09:43 +0300 Subject: [PATCH] Harden container with no-new-privileges --- .gitea/workflows/ci.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index d360c9c..bac7d4a 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -73,6 +73,7 @@ jobs: --restart unless-stopped \ --read-only \ --cap-drop=ALL \ + --security-opt=no-new-privileges:true \ -p 127.0.0.1:8000:8000 \ "$IMAGE"; then echo "New container started" @@ -83,6 +84,7 @@ jobs: --restart unless-stopped \ --read-only \ --cap-drop=ALL \ + --security-opt=no-new-privileges:true \ -p 127.0.0.1:8000:8000 \ "$OLD_IMAGE" exit 1 @@ -110,6 +112,7 @@ jobs: --restart unless-stopped \ --read-only \ --cap-drop=ALL \ + --security-opt=no-new-privileges:true \ -p 127.0.0.1:8000:8000 \ "$OLD_IMAGE" exit 1