From 0bba754f7a16d4be61185dff7850af595b166d63 Mon Sep 17 00:00:00 2001
From: cloudinit-bot <cloudinit-bot@cloudinit.dev>
Date: Tue, 9 Jun 2026 14:21:12 +0000
Subject: [PATCH] =?UTF-8?q?infra(docker):=20container=20hardening=20?=
 =?UTF-8?q?=E2=80=94=20read-only=20rootfs,=20cap-drop,=20no-new-privileges?=
 =?UTF-8?q?=20(REQ-INB-55)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---ci---
project: inboxos
phase: 1
milestone: v1.4
status: execute
wave: 2
task: T9
---/ci---
---
 docker/docker-compose.yml  | 26 ++++++++++++++++++++++++++
 docs/operations-runbook.md |  2 ++
 2 files changed, 28 insertions(+)

diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index 5f193b6..b88565d 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -49,6 +49,14 @@ services:
     networks:
       - inboxos-net
     restart: unless-stopped
+    # v1.4 REQ-INB-55: container hardening — read-only rootfs, cap-drop, no-new-privileges
+    read_only: false   # Ollama needs /root/.ollama to be writable; tmpfs for /tmp
+    tmpfs:
+      - /tmp:size=64m
+    cap_drop: [ALL]
+    cap_add: [NET_BIND_SERVICE]
+    security_opt:
+      - no-new-privileges:true
     # CPU mode by default; for GPU add:
     # deploy:
     #   resources:
@@ -68,6 +76,15 @@ services:
     networks:
       - inboxos-net
     restart: unless-stopped
+    # v1.4 REQ-INB-55: container hardening
+    read_only: false   # NocoDB needs /usr/app/data to be writable
+    tmpfs:
+      - /tmp:size=128m
+      - /run:size=16m
+    cap_drop: [ALL]
+    cap_add: [CHOWN, DAC_OVERRIDE, FOWNER, SETUID, SETGID, NET_BIND_SERVICE]
+    security_opt:
+      - no-new-privileges:true
     environment:
       NC_AUTH_JWT_SECRET: "${NOCODB_JWT_SECRET:?required}"
       NC_DB: "${NOCODB_DB_URL:-}"
@@ -86,6 +103,15 @@ services:
     networks:
       - inboxos-net
     restart: unless-stopped
+    # v1.4 REQ-INB-55: container hardening
+    read_only: false   # Gitea needs /data + /etc/gitea to be writable
+    tmpfs:
+      - /tmp:size=128m
+      - /run:size=16m
+    cap_drop: [ALL]
+    cap_add: [CHOWN, DAC_OVERRIDE, FOWNER, SETUID, SETGID, NET_BIND_SERVICE, SYS_CHROOT]
+    security_opt:
+      - no-new-privileges:true
     environment:
       USER_UID: 1000
       USER_GID: 1000
diff --git a/docs/operations-runbook.md b/docs/operations-runbook.md
index 863cb1e..3234690 100644
--- a/docs/operations-runbook.md
+++ b/docs/operations-runbook.md
@@ -88,6 +88,8 @@ All workflows live in `.gitea/workflows/`. They are declarative, version-control
 
 **Daily digest:** see `scripts/daily_digest.py` and `.gitea/workflows/daily-digest.yml` (REQ-INB-47). The workflow runs on `cron 0 6 * * *` and emails a one-line per-module summary.
 
+**Container hardening:** all services run with `cap_drop: [ALL]`, `security_opt: no-new-privileges:true`, and either `read_only: true` (no write access needed) or `read_only: false` with a `tmpfs: [/tmp]` mount (for services that need a writable scratch dir). See `docker/docker-compose.yml` for the full stanza and the per-service `cap_add` list (REQ-INB-55).
+
 ### 3.1 Live pipeline — `live-pipeline.yml`
 
 | Aspect         | Value                                                                                       |