Great templates! A few suggestions based on long-term Docker hardening experience

[Im-hsh]

First of all, thank you for publishing these templates. They are among the most security-conscious Docker Compose examples I've found and the extensive comments explaining the reasoning behind each decision make them a great learning resource.

I have been doing the same pattern for years and spending a lot of time digging through official repositories, GitHub issues, discussions and community forums to find caveats and workarounds to be able to run my containers with the most hardened configs, So, here are few suggestions that you may consider or discuss:

1. ipc: private

ipc: private

As far as I understand, Docker's default IPC mode is already private, so this line is redundant unless the Docker daemon has been configured with a different default. Omitting it would slightly reduce clutter while keeping the same behavior.

2. Resource limits

The deploy.resources sections are well thought out, but they make the compose files considerably longer.

Many users and myself actually already monitor CPU, memory and PID usage with tools such as Beszel, Prometheus, Grafana, Netdata, etc. and prefer to size containers based on observed usage instead of predefined limits.
It's easy to present status and percentages when the resources are relative to the whole system resource.

Perhaps these limits could be presented as an optional hardening section or documented separately, allowing users to opt in if they want resource enforcement.

3. Running services as a non-root user

Many container images support running with a fixed unprivileged user such as:

user: "1000:1000"

often together with:

read_only: true

when the required writable paths are provided.

For example, my Adguardhome runs perfectly like this: (also caddy, and many others as I will show below ...)

sudo chown -R $USER:$USER /mnt/srv/docker/adguardhome/{conf,work}
# Set /work directory to 0700 (default 0755), as recommended by Adguard for restricted security. 
sudo chmod 700 /mnt/srv/docker/adguardhome/work

services:
  adguardhome:
    image: adguard/adguardhome
    container_name: adguardhome
    restart: always
    user: 1000:1000
    read_only: true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    security_opt:
      - no-new-privileges:true
    networks:
      - dockernetwork
    ports:
      - 53:53/tcp # plain dns over tcp
      - 53:53/udp # plain dns over udp
    #      - 8088:80/tcp # http web interface (remove after caddy reverse proxy setup)
    #      - 3000:3000/tcp # initial setup web interface (remove after initial setup)
    environment:
      - TZ=${TZ}
    volumes:
      - ${DOCKER_DIR}/adguard-home/conf:/opt/adguardhome/conf
      - ${DOCKER_DIR}/adguard-home/work:/opt/adguardhome/work
networks:
  dockernetwork:
    external: true

Also, Postgres and Redis in my Nextcloud stack

services:
  nextcloud-db:
    image: postgres:17
    container_name: nextcloud-db
    restart: unless-stopped
    user: 1000:1000
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /tmp:rw,noexec,nosuid,nodev
      - /run/postgresql:rw,noexec,nosuid,nodev
    networks:
      - nextcloud-backend
    environment:
      - TZ=${TIMEZONE}
      - POSTGRES_DB=${NEXTCLOUD_DB_NAME}
      - POSTGRES_USER=${NEXTCLOUD_DB_USER}
      - POSTGRES_PASSWORD=${NEXTCLOUD_DB_PASSWORD}
    volumes:
      # Postgres 18 use /var/lib/postgresql
      - ${DOCKER_DIR}/nextcloud/db:/var/lib/postgresql/data
    healthcheck:
      test: [ "CMD", "pg_isready", "-q", "-d", "${NEXTCLOUD_DB_NAME}", "-U", "${NEXTCLOUD_DB_USER}" ]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s

  nextcloud-redis:
    image: docker.io/valkey/valkey:latest
    container_name: nextcloud-redis
    restart: unless-stopped
    user: 1000:1000
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    networks:
      - nextcloud-backend
    volumes:
      - ${DOCKER_DIR}/nextcloud/redis:/data
    healthcheck:
      test: ["CMD", "valkey-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 60s

  nextcloud:
    image: lscr.io/linuxserver/nextcloud:latest
    container_name: nextcloud
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - dockernetwork
      - nextcloud-backend
    depends_on:
      nextcloud-db:
        condition: service_healthy
      nextcloud-redis:
        condition: service_healthy
    #    ports:
    #      - 8080:80
    volumes:
      - ${DOCKER_DIR}/nextcloud/data:/data
      - ${DOCKER_DIR}/nextcloud/config:/config
    environment:
      - TZ=${TZ}
      - PUID=1000
      - PGID=1000
      - REDIS_HOST=nextcloud-redis
      - REDIS_PORT=6379
      - DOCKER_MODS=linuxserver/mods:nextcloud-notify-push
      - TRUSTED_DOMAINS=https://${NEXTCLOUD_DOMAIN}
networks:
networks:
  nextcloud-backend:
    name: nextcloud-backend
    internal: true
  dockernetwork:
    external: true

I understand this is image-dependent and isn't universally applicable but it may be worth documenting these opportunities where they exist.

Actually I made a matrix of my services and which ones accepts hardened configs after long time of tinkering

Container	User	read-only	no-new-privileges	cap_drop	Healthcheck	OIDC Support	cap_add	tmpfs
Actual Budget	1000:1000	✅	✅	ALL	Yes	Yes
AdGuard Home	1000:1000	✅	✅	ALL	N/A	No	NET_BIND_SERVICE
Arcane	1000:1000	✅	✅	ALL	Yes	Yes
BentoPDF	1000:1000	✅	✅	ALL	Yes	No		/etc/nginx:uid=1000,gid=1000,rw,noexec,nosuid,nodev /var/cache/nginx:uid=1000,gid=1000,rw,noexec,nosuid,nodev /var/lib/nginx/tmp:uid=1000,gid=1000,rw,noexec,nosuid,nodev
Caddy	1000:1000	✅	✅	ALL	—	No WebUI	NET_BIND_SERVICE
FileBrowser Quantum	1000:1000	✅	✅	ALL	Embedded	Yes
Homepage	1000:1000	✅	✅	ALL	Embedded	No
Miniflux	1000:1000	✅	✅	ALL	Yes	Yes
NetBird Peer	1000:1000	✅	✅	ALL	—	No WebUI	NET_ADMIN
NoteDiscovery	1000:1000	✅	✅	ALL	Embedded	No
ntfy	1000:1000	✅	✅	ALL	—	No		/tmp:rw,noexec,nosuid,nodev
Papra	1000:1000	✅	✅	ALL	—	Yes		/tmp:rw,noexec,nosuid,nodev
Pocket ID	1000:1000	✅	✅	ALL	Embedded	N/A
Signal CLI REST API	1000:1000	✅	✅	ALL	Embedded	No WebUI		/tmp:rw,noexec,nosuid,nodev,uid=1000,gid=1000 /run:rw,nosuid,exec,nodev,uid=1000,gid=1000
Tinyauth	1000:1000	✅	✅	ALL	Embedded	Yes
Vaultwarden	1000:1000	✅	✅	ALL	Embedded	N/A
Zerobyte	1000:1000	✅	✅	ALL	—	Yes
Immich	1000:1000	—	✅	ALL	Embedded	Yes
OpenCloud	1000:1000	—	✅	ALL	—	Yes
Docker Socket Proxy	—	✅	✅	ALL	—	No WebUI		/tmp:rw,noexec,nosuid,nodev /run:rw,noexec,nosuid,nodev
Paperless-ngx	—	—	✅	ALL	Embedded	Yes	CHOWN DAC_OVERRIDE FOWNER SETGID SETUID
Nextcloud (LinuxServer)	PUID=1000 PGID=1000	—	✅	—	—	Yes
wg-easy	—	✅	✅	ALL	Embedded / Override	—	NET_RAW NET_ADMIN SYS_MODULE CHOWN DAC_OVERRIDE	/run:rw,noexec,nosuid,nodev

The only service that I struggle to implement these measures on is Nextcloud, it has too many moving parts and always fails to accomaodate these configs, and I'm with you that AIO is just not meant to be controlled or hardened, So I accepted to use Linuxserver image LSIO as they are very reputable and actually make security updates even faster than the community image of Nextcloud Docker and while both initially runs as root then drop privileges , I don't see a difference except trusting the source of image.

Overall, these are only minor suggestions. I think this repository is one of the best documented and most security-focused Docker Compose collections available and I appreciate the amount of work that has clearly gone into it.

Thanks again for sharing it! And please I'm welcoming any suggestions or correction to my current setup.

[Im-hsh]

Also you can omit the port exposure overall, and let caddy reach the containers internal port
I commented out all ports: section in my compose files , except Adguardhome 53:53, Caddy 80&43 and wg-easy for 51820

example:

services:
  bentopdf:
    image: ghcr.io/alam00000/bentopdf-simple:latest
    container_name: bentopdf
    restart: unless-stopped
    user: 1000:1000
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    tmpfs:
      - /etc/nginx:uid=1000,gid=1000,rw,noexec,nosuid,nodev
      - /var/cache/nginx:uid=1000,gid=1000,rw,noexec,nosuid,nodev
      - /var/lib/nginx/tmp:uid=1000,gid=1000,rw,noexec,nosuid,nodev
#      - /var/run:uid=1000,gid=1000,rw,noexec,nosuid,nodev
    networks:
      - dockernetwork
    #    ports:
    #      - 8080:8080
    environment:
      - TZ=${TZ}
#      - DISABLE_TOOLS="edit-pdf,sign-pdf,encrypt-pdf" # Tool IDs are the page URL without .html
#      - DISABLE_IPV6=true # Incompatible with read_only, as it modifies nginx.conf at startup 
    healthcheck:
      test: ['CMD', 'wget', '--spider', '-q', 'http://localhost:8080']
      interval: 30s
      timeout: 10s
      retries: 3
networks:
  dockernetwork:
    external: true

Caddyfile:

bentopdf.{$MY_DOMAIN} {
    import security_headers
    reverse_proxy bentopdf:8080
    header Cross-Origin-Opener-Policy "same-origin"
    header Cross-Origin-Embedder-Policy "require-corp"
}