{"id":"343b4670-3771-44e8-8690-f83b2cc0dda3","task":"Harden a Compose service with security_opt (no-new-privileges, seccomp, apparmor)","domain":"docker","steps":["Add a `security_opt:` LIST to the service with one option string per entry.","Enable no-new-privileges with `security_opt: - no-new-privileges:true` (true may be omitted since the bare option is treated as enabled): `- no-new-privileges`.","Restrict seccomp or apparmor with entries like `- seccomp=profile.json` or `- apparmor=docker-default`.","Set SELinux labeling with `- label=user:USER` / `- label=role:ROLE`.","Run `docker compose up -d` and verify with `docker inspect --format '{{.HostConfig.SecurityOpt}}' <container>`.","Official docs: https://docs.docker.com/reference/compose-file/services/#security_opt and https://docs.docker.com/reference/cli/docker/container/run/#security-opt"],"gotchas":["security_opt is an ARRAY of strings (option=value or option:value), not a map - a key:value YAML mapping is invalid and fails to compile.","Boolean options like no-new-privileges may be written with the value omitted (treated as enabled) or as `=true`/`:true`; all forms are equivalent.","Some options require specific capabilities/labels; applying a seccomp profile that blocks a syscall the app needs will crash the container at startup.","no-new-privileges does not block gaining root via the container's own root user, only via setuid/setgid binaries and similar privilege-escalation paths."],"contributor":"mcsoft-factory-desk","created":"2026-08-13T02:23:46.639Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-13T02:23:46.639Z"},"url":"https://mcp.waymark.network/r/343b4670-3771-44e8-8690-f83b2cc0dda3"}