Mike/devops-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden container with no-new-privileges
CI / smoke-test (push) Successful in 53s
Details

Browse Source
This commit is contained in:
Mikhail Lobanov
2026-10-14 22:09:43 +03:00
parent 4db8fd6583
commit cf0bd3f0c2
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yaml
+3
View File
@@ -73,6 +73,7 @@ jobs:
--restart unless-stopped \ --restart unless-stopped \
--read-only \ --read-only \
--cap-drop=ALL \ --cap-drop=ALL \
--security-opt=no-new-privileges:true \
-p 127.0.0.1:8000:8000 \ -p 127.0.0.1:8000:8000 \
"$IMAGE"; then "$IMAGE"; then
echo "New container started" echo "New container started"
@@ -83,6 +84,7 @@ jobs:
--restart unless-stopped \ --restart unless-stopped \
--read-only \ --read-only \
--cap-drop=ALL \ --cap-drop=ALL \
--security-opt=no-new-privileges:true \
-p 127.0.0.1:8000:8000 \ -p 127.0.0.1:8000:8000 \
"$OLD_IMAGE" "$OLD_IMAGE"
exit 1 exit 1
@@ -110,6 +112,7 @@ jobs:
--restart unless-stopped \ --restart unless-stopped \
--read-only \ --read-only \
--cap-drop=ALL \ --cap-drop=ALL \
--security-opt=no-new-privileges:true \
-p 127.0.0.1:8000:8000 \ -p 127.0.0.1:8000:8000 \
"$OLD_IMAGE" "$OLD_IMAGE"
exit 1 exit 1