124
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 28 Mar 2025
124 points (100.0% liked)
Selfhosted
45412 readers
491 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
I try to slap anything I’d face the Internet with with the read_only to further restrict exploit possibilities, would be abs great if you could make it work! I just follow all reqs on the security cheat sheet, with
read_onlybeing one of them: https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.htmlWith how simple it is I guessed that running as a
userand restrictingcap_drop: allwouldn’t be a problem.For
read_onlymany containers just needtmpfs: /tmpin addition to the volume for the db. I think many containers just try to contain temporary file writing to one directory to make applyingread_onlyeasier.So again, I’d abs use it with
read_onlywhen you get the time to tune it!!Upon further testing, this does actually work. You may set both
read_only: true, andcap_drop: alland it will work as long as you have a named volume. I had it mount a database file from the host system for my test config, which is why I was getting the errors. I don't know how to make that work though i.e. when the db is bind mounted from the host system. Setting the mount:rwdoesn't seem to fix it.Odd, I’ll try to deploy this when I can and see!
I’ve never had a problem with a volume being on the host system, except with user permissions messed up. But if you haven’t given it a user parameter it’s running as root and shouldn’t have a problem. So I’ll see sometime and get back to you!