tweaking, hardening

docker/glutton/Dockerfile

@@ -4,16 +4,14 @@ FROM alpine
 ADD dist/ /root/dist/
   
 # Setup apk
-RUN apk -U --no-cache add bash \
+RUN apk -U --no-cache add \
                    build-base \
                    git \
                    go \
                    g++ \
                    iptables-dev \
                    libnetfilter_queue-dev \
-                          libpcap-dev \
+                   libpcap-dev && \
-                          procps \
-                          upx && \
 
 # Setup go, glutton
     export GOPATH=/opt/go/ && \
@@ -28,11 +26,10 @@ RUN apk -U --no-cache add bash \
     mv /opt/go/src/github.com/mushorg/glutton/bin /opt/glutton/ && \
     mv /opt/go/src/github.com/mushorg/glutton/config /opt/glutton/ && \
     mv /opt/go/src/github.com/mushorg/glutton/rules /opt/glutton/ && \
-    upx /opt/glutton/bin/server && \
 
 # Setup user, groups and configs
     addgroup -g 2000 glutton && \
-    adduser -S -s /bin/bash -u 2000 -D -g 2000 glutton && \
+    adduser -S -s /bin/ash -u 2000 -D -g 2000 glutton && \
     mkdir -p /var/log/glutton && \
     mv /root/dist/rules.yaml /opt/glutton/rules/ && \
 
@@ -40,8 +37,7 @@ RUN apk -U --no-cache add bash \
     apk del --purge build-base \
                     git \
                     go \
-                    g++ \
+                    g++ && \
-                    upx && \
     rm -rf /var/cache/apk/* \
            /opt/go \
            /root/dist

docker/glutton/docker-compose.yml

@@ -8,10 +8,13 @@ services:
     build: .
     container_name: glutton
     restart: always
+    tmpfs:
+     - /var/lib/glutton:uid=2000,gid=2000
     network_mode: "host"
     cap_add:
      - NET_ADMIN
     image: "dtagdevsec/glutton:1804"
+    read_only: true
     volumes:
      - /data/glutton/log:/var/log/glutton
      - /root/tpotce/docker/glutton/dist/rules.yaml:/opt/glutton/rules/rules.yaml