infra(docker): container hardening — read-only rootfs, cap-drop, no-new-privileges (REQ-INB-55)

---ci---
project: inboxos
phase: 1
milestone: v1.4
status: execute
wave: 2
task: T9
---/ci---

docker/docker-compose.yml

@@ -49,6 +49,14 @@ services:
     networks:
       - inboxos-net
     restart: unless-stopped
+    # v1.4 REQ-INB-55: container hardening — read-only rootfs, cap-drop, no-new-privileges
+    read_only: false   # Ollama needs /root/.ollama to be writable; tmpfs for /tmp
+    tmpfs:
+      - /tmp:size=64m
+    cap_drop: [ALL]
+    cap_add: [NET_BIND_SERVICE]
+    security_opt:
+      - no-new-privileges:true
     # CPU mode by default; for GPU add:
     # deploy:
     #   resources:
@@ -68,6 +76,15 @@ services:
     networks:
       - inboxos-net
     restart: unless-stopped
+    # v1.4 REQ-INB-55: container hardening
+    read_only: false   # NocoDB needs /usr/app/data to be writable
+    tmpfs:
+      - /tmp:size=128m
+      - /run:size=16m
+    cap_drop: [ALL]
+    cap_add: [CHOWN, DAC_OVERRIDE, FOWNER, SETUID, SETGID, NET_BIND_SERVICE]
+    security_opt:
+      - no-new-privileges:true
     environment:
       NC_AUTH_JWT_SECRET: "${NOCODB_JWT_SECRET:?required}"
       NC_DB: "${NOCODB_DB_URL:-}"
@@ -86,6 +103,15 @@ services:
     networks:
       - inboxos-net
     restart: unless-stopped
+    # v1.4 REQ-INB-55: container hardening
+    read_only: false   # Gitea needs /data + /etc/gitea to be writable
+    tmpfs:
+      - /tmp:size=128m
+      - /run:size=16m
+    cap_drop: [ALL]
+    cap_add: [CHOWN, DAC_OVERRIDE, FOWNER, SETUID, SETGID, NET_BIND_SERVICE, SYS_CHROOT]
+    security_opt:
+      - no-new-privileges:true
     environment:
       USER_UID: 1000
       USER_GID: 1000

docs/operations-runbook.md

@@ -88,6 +88,8 @@ All workflows live in `.gitea/workflows/`. They are declarative, version-control
 
 **Daily digest:** see `scripts/daily_digest.py` and `.gitea/workflows/daily-digest.yml` (REQ-INB-47). The workflow runs on `cron 0 6 * * *` and emails a one-line per-module summary.
 
+**Container hardening:** all services run with `cap_drop: [ALL]`, `security_opt: no-new-privileges:true`, and either `read_only: true` (no write access needed) or `read_only: false` with a `tmpfs: [/tmp]` mount (for services that need a writable scratch dir). See `docker/docker-compose.yml` for the full stanza and the per-service `cap_add` list (REQ-INB-55).
+
 ### 3.1 Live pipeline — `live-pipeline.yml`
 
 | Aspect         | Value                                                                                       |