From 8221cc2d3793a9a3caa3c22494411ee9683b90d3 Mon Sep 17 00:00:00 2001
From: Viet Tran <viettranx@gmail.com>
Date: Sun, 22 Feb 2026 18:39:57 +0700
Subject: [PATCH] Add Docker security hardening with resource limits and
 capability restrictions

Apply security best practices to goclaw service: drop all capabilities, enable no-new-privileges, set read-only root filesystem with tmpfs for /tmp, limit PIDs to 200, and cap memory at 1G with 2 CPU cores.
---
 docker-compose.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index fa2ae4dd..a8510397 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -23,6 +23,19 @@ services:
       - GOCLAW_CONFIG=/app/data/config.json
     volumes:
       - goclaw-data:/app/data
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    read_only: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=256m
+    pids_limit: 200
+    deploy:
+      resources:
+        limits:
+          memory: 1G
+          cpus: '2.0'
     restart: unless-stopped
 
 volumes: