diff options
| author | Gab <24553253+gabrix73@users.noreply.github.com> | 2026-02-04 04:29:19 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-02-04 04:29:19 +0100 |
| commit | 52843420de58016166f478af62300825b8274de8 (patch) | |
| tree | 922b0c053cb62eb5ee82bb3498788d2d70eefb5f | |
| parent | be3fdba940f858e6faa547067c70af6ede0fc410 (diff) | |
| download | vapordrop-52843420de58016166f478af62300825b8274de8.tar.gz vapordrop-52843420de58016166f478af62300825b8274de8.tar.xz vapordrop-52843420de58016166f478af62300825b8274de8.zip | |
Revise Docker image CI configuration with security settings
| -rw-r--r-- | .github/workflows/docker-image.yml | 116 |
1 files changed, 116 insertions, 0 deletions
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml new file mode 100644 index 0000000..06c37a3 --- /dev/null +++ b/.github/workflows/docker-image.yml @@ -0,0 +1,116 @@ +# ============================================================================= +# VAPORDROP - DOCKER COMPOSE HARDENED +# ============================================================================= + +services: + vapordrop: + build: + context: . + dockerfile: Dockerfile + volumes: + - ./static:/app/static:ro + - ./file_storage:/app/file_storage + container_name: vapordrop + + # ========================================================================= + # SICUREZZA CRITICA + # ========================================================================= + + # Permetti a MemGuard di bloccare la RAM + cap_add: + - IPC_LOCK + + # Rimuovi tutte le altre capabilities + cap_drop: + - ALL + + # Security options + security_opt: + - no-new-privileges:true + # Seccomp opzionale - può bloccare alcune syscall Tor + # - seccomp:seccomp-profile.json + + # Disabilita core dumps + ulimits: + core: + soft: 0 + hard: 0 + memlock: + soft: -1 # Unlimited - necessario per MemGuard + hard: -1 + nofile: + soft: 65536 + hard: 65536 + + # Read-only root filesystem + read_only: true + + # Filesystem temporanei in RAM + tmpfs: + - /tmp:size=256M,mode=1777,uid=1000,gid=1000 + - /run:size=64M,mode=1777 + + # ========================================================================= + # ENVIRONMENT + # ========================================================================= + environment: + # Chiave da passare esternamente + - VAPOR_KEY=${VAPOR_KEY:?VAPOR_KEY è obbligatoria} + + # ========================================================================= + # NETWORKING + # ========================================================================= + + # Network isolata + networks: + - vapor_net + + # Nessuna porta esposta (solo Hidden Service) + # ports: [] + + # ========================================================================= + # RISORSE + # ========================================================================= + deploy: + resources: + limits: + cpus: '2' + memory: 512M + reservations: + cpus: '0.5' + memory: 128M + + # ========================================================================= + # RESTART POLICY + # ========================================================================= + restart: unless-stopped + + # ========================================================================= + # LOGGING MINIMALE (no sensitive data) + # ========================================================================= + logging: + driver: "json-file" + options: + max-size: "10m" + max-file: "3" + + # ========================================================================= + # HEALTHCHECK + # ========================================================================= + healthcheck: + test: ["CMD-SHELL", "pgrep -x vapordrop || exit 1"] + interval: 30s + timeout: 10s + retries: 3 + start_period: 120s + +# ============================================================================= +# NETWORK ISOLATA +# ============================================================================= +networks: + vapor_net: + driver: bridge + internal: false # Necessario per connessione Tor + ipam: + config: + - subnet: 172.28.0.0/16 |