tweaking, hardening

docker/glastopf/Dockerfile

@@ -12,7 +12,6 @@ RUN apk -U --no-cache add autoconf \
                git \
                libffi \
                libffi-dev \
-               libcap \
                make \
                py-asn1 \
                py-cffi \
@@ -67,7 +66,6 @@ RUN apk -U --no-cache add autoconf \
     python setup.py install && \
     cd / && \
     rm -rf /opt/glastopf /tmp/* /var/tmp/* && \
-    setcap cap_net_bind_service=+ep /usr/bin/glastopf-runner && \
 
 # Setup user, groups and configs
     addgroup -g 2000 glastopf && \
@@ -86,5 +84,5 @@ RUN apk -U --no-cache add autoconf \
     rm -rf /var/cache/apk/*
 
 # Set workdir and start glastopf
-WORKDIR /opt/glastopf/
-CMD ["glastopf-runner"]
+WORKDIR /tmp/glastopf/
+CMD cp /opt/glastopf/glastopf.cfg /tmp/glastopf && glastopf-runner

docker/glastopf/docker-compose.yml

@@ -9,12 +9,17 @@ services:
   glastopf:
     build: .
     container_name: glastopf
+    environment:
+      - PYTHON_EGG_CACHE=/tmp/glastopf
+    tmpfs:
+      - /tmp/glastopf:exec
     restart: always
     networks:
      - glastopf_local
     ports:
      - "80:80"
     image: "dtagdevsec/glastopf:1804"
+    read_only: true
     volumes:
      - /data/glastopf/db:/opt/glastopf/db
      - /data/glastopf/log:/opt/glastopf/log