IMAGEHARDER/docker-compose.yml at main · SWORDIntel/IMAGEHARDER · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
version: '3.8'

services:
  media-processor:
    build:
      context: .
      dockerfile: Dockerfile
    image: imageharder:latest
    container_name: media-processor-hardened

    # Security hardening
    security_opt:
      - no-new-privileges:true
      - seccomp:./seccomp-profile.json
      - apparmor:docker-default

    # Capabilities (drop all, add only what's needed)
    cap_drop:
      - ALL

    # Read-only root filesystem
    read_only: true

    # Tmpfs for temporary files
    tmpfs:
      - /tmp:noexec,nosuid,nodev,size=100m

    # Resource limits
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2G
        reservations:
          cpus: '0.5'
          memory: 512M

    # Volumes (minimal access)
    volumes:
      - ./input:/data/input:ro
      - ./output:/data/output:rw
      - ./quarantine:/data/quarantine:rw

    # Network isolation
    networks:
      - processing-net

    # Restart policy
    restart: unless-stopped

    # Logging
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"

    # Environment variables
    environment:
      - RUST_LOG=info
      - MAX_FILE_SIZE=100000000

  # Optional: Monitoring with Prometheus
  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro
      - prometheus-data:/prometheus
    ports:
      - "9090:9090"
    networks:
      - processing-net
    restart: unless-stopped

  # Optional: Grafana for dashboards
  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    ports:
      - "3000:3000"
    volumes:
      - grafana-data:/var/lib/grafana
    networks:
      - processing-net
    restart: unless-stopped
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=changeme

networks:
  processing-net:
    driver: bridge
    ipam:
      config:
        - subnet: 172.28.0.0/16

volumes:
  prometheus-data:
  grafana-data: