Harden container with no-new-privileges

2026-10-14 22:09:43 +03:00
parent 4db8fd6583
commit cf0bd3f0c2
1 changed files with 3 additions and 0 deletions
@@ -73,6 +73,7 @@ jobs:
            --restart unless-stopped \
            --read-only \
            --cap-drop=ALL \
+            --security-opt=no-new-privileges:true \
            -p 127.0.0.1:8000:8000 \
            "$IMAGE"; then
            echo "New container started"
@@ -83,6 +84,7 @@ jobs:
              --restart unless-stopped \
              --read-only \
              --cap-drop=ALL \
+              --security-opt=no-new-privileges:true \
              -p 127.0.0.1:8000:8000 \
              "$OLD_IMAGE"
            exit 1
@@ -110,6 +112,7 @@ jobs:
              --restart unless-stopped \
              --read-only \
              --cap-drop=ALL \
+              --security-opt=no-new-privileges:true \
              -p 127.0.0.1:8000:8000 \
              "$OLD_IMAGE"
            exit 1