mirror of
https://github.com/tiennm99/goclaw.git
synced 2026-07-31 10:26:16 +00:00
Viet Tran
8221cc2d37
Apply security best practices to goclaw service: drop all capabilities, enable no-new-privileges, set read-only root filesystem with tmpfs for /tmp, limit PIDs to 200, and cap memory at 1G with 2 CPU cores.
43 lines
1.1 KiB
YAML
43 lines
1.1 KiB
YAML
# Base docker-compose — shared service definition.
|
|
# Combine with an overlay for your deployment mode:
|
|
#
|
|
# Standalone: docker compose -f docker-compose.yml -f docker-compose.standalone.yml up
|
|
# Managed: docker compose -f docker-compose.yml -f docker-compose.managed.yml up
|
|
# Managed+OTel: docker compose -f docker-compose.yml -f docker-compose.managed.yml -f docker-compose.otel.yml up
|
|
|
|
services:
|
|
goclaw:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
args:
|
|
ENABLE_OTEL: "false"
|
|
ports:
|
|
- "${GOCLAW_PORT:-18790}:18790"
|
|
env_file:
|
|
- path: .env
|
|
required: false
|
|
environment:
|
|
- GOCLAW_HOST=0.0.0.0
|
|
- GOCLAW_PORT=18790
|
|
- GOCLAW_CONFIG=/app/data/config.json
|
|
volumes:
|
|
- goclaw-data:/app/data
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
read_only: true
|
|
tmpfs:
|
|
- /tmp:rw,noexec,nosuid,size=256m
|
|
pids_limit: 200
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 1G
|
|
cpus: '2.0'
|
|
restart: unless-stopped
|
|
|
|
volumes:
|
|
goclaw-data:
|