(tooling-trusted-releases) branch sbp updated: Prevent privilege escalation in the compose containers

[sb...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

sbp pushed a commit to branch sbp
in repository https://gitbox.apache.org/repos/asf/tooling-trusted-releases.git


The following commit(s) were added to refs/heads/sbp by this push:
     new f29c190f Prevent privilege escalation in the compose containers
f29c190f is described below

commit f29c190f9f11182bb49b5ab20bdbd74f579307ef
Author: Sean B. Palmer <se...@miscoranda.com>
AuthorDate: Fri Jul 17 16:14:06 2026 +0100

    Prevent privilege escalation in the compose containers
---
 docker-compose.yml       | 2 ++
 tests/docker-compose.yml | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index dd5dba2a..42d1659c 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -20,6 +20,8 @@ services:
     ports:
       - 8080:8080
     init: true
+    security_opt:
+      - no-new-privileges:true
     healthcheck:
       test: ["CMD", "curl", "-k", "-f", "https://127.0.0.1:8080/"]
       interval: 30s
diff --git a/tests/docker-compose.yml b/tests/docker-compose.yml
index 4a1109d8..0219560d 100644
--- a/tests/docker-compose.yml
+++ b/tests/docker-compose.yml
@@ -11,6 +11,8 @@ services:
     networks:
       - test-network
     init: true
+    security_opt:
+      - no-new-privileges:true
     healthcheck:
       test: ["CMD", "curl", "-k", "-f", "https://127.0.0.1:8080/"]
       interval: 2s
@@ -34,6 +36,8 @@ services:
       - ../start-dev.sh:/opt/atr/start-atr.sh
       - atr-dev-state:/opt/atr/state
     init: true
+    security_opt:
+      - no-new-privileges:true
     healthcheck:
       test: ["CMD", "curl", "-k", "-f", "https://127.0.0.1:8080/"]
       interval: 2s


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org