Fix #8: Limit container runtime permissions in compose files

Signed-off-by: Timo Reichl <[email protected]>
thetredev · Jun 6, 2022 · d36e1f8 · d36e1f8
1 parent d202377
commit d36e1f8
Show file tree

Hide file tree

Showing 3 changed files with 42 additions and 0 deletions.
diff --git a/compose/docker-compose.csgo.yml b/compose/docker-compose.csgo.yml
@@ -1,5 +1,11 @@
 version: '3.7'
 
+networks:
+  srcds:
+    driver: bridge
+    driver_opts:
+      com.docker.network.bridge.enable_icc: 0
+
 services:
   csgo:
     image: ghcr.io/thetredev/steamcmd:csgo-latest
@@ -17,6 +23,12 @@ services:
       #- "27015:27015/tcp"
     volumes:
       - ./csgo:/var/lib/steamcmd/server
+    networks:
+      - srcds
+    security_opt:
+      - no-new-privileges
+    tmpfs:
+      - /tmp
     ulimits:
       nofile:
         soft: 2048

diff --git a/compose/docker-compose.css.yml b/compose/docker-compose.css.yml
@@ -1,5 +1,11 @@
 version: '3.7'
 
+networks:
+  srcds:
+    driver: bridge
+    driver_opts:
+      com.docker.network.bridge.enable_icc: 0
+
 services:
   css:
     image: ghcr.io/thetredev/steamcmd:css-latest
@@ -17,6 +23,12 @@ services:
       #- "27015:27015/tcp"
     volumes:
       - ./css:/var/lib/steamcmd/server
+    networks:
+      - srcds
+    security_opt:
+      - no-new-privileges
+    tmpfs:
+      - /tmp
     ulimits:
       nofile:
         soft: 2048

diff --git a/compose/docker-compose.multiple.yml b/compose/docker-compose.multiple.yml
@@ -1,5 +1,11 @@
 version: '3.7'
 
+networks:
+  srcds:
+    driver: bridge
+    driver_opts:
+      com.docker.network.bridge.enable_icc: 0
+
 services:
   css:
     image: ghcr.io/thetredev/steamcmd:css-latest
@@ -17,6 +23,12 @@ services:
       #- "27015:27015/tcp"
     volumes:
       - ./css:/var/lib/steamcmd/server
+    networks:
+      - srcds
+    security_opt:
+      - no-new-privileges
+    tmpfs:
+      - /tmp
     ulimits:
       nofile:
         soft: 2048
@@ -46,6 +58,12 @@ services:
       #- "27016:27016/tcp"
     volumes:
       - ./csgo:/var/lib/steamcmd/server
+    networks:
+      - srcds
+    security_opt:
+      - no-new-privileges
+    tmpfs:
+      - /tmp
     ulimits:
       nofile:
         soft: 2048