From 801b08a1ccb3f5137f00735586468d4a22632edf Mon Sep 17 00:00:00 2001 From: Platon47 <64787001+Platon47@users.noreply.github.com> Date: Mon, 16 Mar 2026 11:11:14 +0300 Subject: [PATCH] security: add no-new-privileges to docker-compose.yml --- docker-compose.yml | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 6dd4b7ce..a61711ca 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -9,7 +9,7 @@ #--- volumes: etc_wireguard: - lego_data: # Persists lego account + cert data across restarts + lego_data: # Persists lego account + cert data across restarts services: wg-easy: @@ -22,23 +22,23 @@ services: - PORT=51821 - HOST=0.0.0.0 - INSECURE=false - - LEGO_ENABLED=true # enables TLS + - LEGO_ENABLED=true # enables TLS # -- AUTO cert mode (lego obtains cert inside container) --- # Uncomment and fill in to enable automatic cert issuance: # - LEGO_EMAIL=you@example.com # - LEGO_IP=YOUR_SERVER_PUBLIC_IP - # - LEGO_CHALLENGE=http # or: tls-alpn (needs port 443) - # - LEGO_DATA_DIR=/root/lego-data # default - # - LEGO_RENEW_INTERVAL=432000 # renewal check in seconds (5 days) + # - LEGO_CHALLENGE=http # or: tls-alpn (needs port 443) + # - LEGO_DATA_DIR=/root/lego-data # default + # - LEGO_RENEW_INTERVAL=432000 # renewal check in seconds (5 days) # -- MANUAL cert mode (mount certs from host) --- # Pre-provision certs: chmod 600 /root/cert/ip/privkey.pem # Then mount: /root/cert/ip:/root/cert/ip:ro (see volumes below) # -- Optional: WireGuard settings --- - # - WG_HOST=111.22.3.4 # set via Web UI (v15+) - # - PASSWORD_HASH= # set via Web UI (v15+) + # - WG_HOST=111.22.3.4 # set via Web UI (v15+) + # - PASSWORD_HASH= # set via Web UI (v15+) # - WG_DEFAULT_DNS=1.1.1.1 # - WG_DEFAULT_ADDRESS=10.8.0.x # - WG_MTU=1420 @@ -54,13 +54,16 @@ services: # AUTO mode: persist lego account and cert data - lego_data:/root/lego-data ports: - - "51820:51820/udp" # WireGuard VPN - - "51821:51821/tcp" # wg-easy admin UI (HTTPS) - # - "80:80/tcp" # Uncomment ONLY for LEGO http-01 challenge (AUTO mode) + - "51820:51820/udp" # WireGuard VPN + - "51821:51821/tcp" # wg-easy admin UI (HTTPS) + # - "80:80/tcp" # Uncomment ONLY for LEGO http-01 challenge (AUTO mode) restart: unless-stopped cap_add: - NET_ADMIN - SYS_MODULE + # Prevent privilege escalation inside the container + security_opt: + - no-new-privileges:true sysctls: - net.ipv4.ip_forward=1 - net.ipv4.conf.all.src_valid_mark=1