feat(security): harden Firefly III in external compose - #981
Conversation
Adds security hardening to Firefly service in docker-compose.external.yml: - cap_drop ALL + cap_add NET_BIND_SERVICE, CHOWN, SETGID, SETUID - security_opt no-new-privileges - tmpfs for Laravel framework cache/sessions/views - healthcheck via /api/v1/about (Laravel built-in) - resource limits (2 CPU / 1G memory) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughSecurity hardening and resource controls are added to the firefly service in the Docker Compose configuration, including capability restrictions, filesystem protections via tmpfs mounts, container health checks, and CPU/memory constraints. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Docker Hardening ValidationHardening Validation ReportValidated: Mon Mar 16 14:22:02 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
Updates Production Audit Checklist and Phase 3 after Firefly compose hardening (PR #981): - Docker hardening: Partial → GREEN - /healthz: MISSING → Partial (/api/v1/about probe) - env.shared: Unknown → GREEN - Phase 3 roadmap items struck through as completed Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
pmoves/docker-compose.external.yml (1)
83-90: Removedeploy.resources.reservations; use service-levelmem_limitandcpusfor cross-platform enforcement.In Docker Compose V2 non-Swarm mode,
deploy.resources.reservationsis not enforced—onlydeploy.resources.limitsapplies. The reservations block here provides no actual resource guarantee and becomes a false safety signal. For consistent cross-platform behavior (Windows/WSL/Linux), use service-level properties instead:mem_limit: 1G cpus: "2.0"If you keep
deploy.resources.limitsfor tooling compatibility, ensure these values match your service-level settings.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pmoves/docker-compose.external.yml` around lines 83 - 90, Remove the deploy.resources.reservations block (deploy.resources.reservations) because it isn't enforced in non-Swarm Compose; instead add service-level resource settings mem_limit and cpus (e.g., mem_limit: 1G and cpus: "2.0") to the service definition and ensure any existing deploy.resources.limits values match those service-level settings for consistency across platforms.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pmoves/docker-compose.external.yml`:
- Around line 67-69: The cap NET_BIND_SERVICE in the cap_add list is unnecessary
for a service exposing port 8080; remove NET_BIND_SERVICE from the cap_add block
(leave CHOWN) in pmoves/docker-compose.external.yml or make the capability
conditional only when the process will bind a privileged port (<1024); update
the cap_add list so it no longer grants NET_BIND_SERVICE unless explicitly
required.
---
Nitpick comments:
In `@pmoves/docker-compose.external.yml`:
- Around line 83-90: Remove the deploy.resources.reservations block
(deploy.resources.reservations) because it isn't enforced in non-Swarm Compose;
instead add service-level resource settings mem_limit and cpus (e.g., mem_limit:
1G and cpus: "2.0") to the service definition and ensure any existing
deploy.resources.limits values match those service-level settings for
consistency across platforms.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: ff1fdf82-30f7-480c-8028-e9d87145085f
📒 Files selected for processing (1)
pmoves/docker-compose.external.yml
Firefly III listens on port 8080 (unprivileged), so NET_BIND_SERVICE is not needed. Docker port mapping handles host-side binding. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Docker Hardening ValidationHardening Validation ReportValidated: Mon Mar 16 14:38:37 UTC 2026Services CheckedPMOVES.AI Docker Hardening Validation[INFO] Checking: pmoves/docker-compose.hardened.yml [INFO] Validating: hi-rag-gateway-v2 [INFO] Validating: extract-worker [INFO] Validating: langextract [INFO] Validating: presign [INFO] Validating: render-webhook [INFO] Validating: retrieval-eval [INFO] Validating: pdf-ingest [INFO] Validating: jellyfin-bridge [INFO] Validating: invidious-companion-proxy [INFO] Validating: ffmpeg-whisper [INFO] Validating: media-video [INFO] Validating: media-audio [INFO] Validating: hi-rag-gateway-v2-gpu [INFO] Validating: hi-rag-gateway-gpu [INFO] Validating: deepresearch [INFO] Validating: supaserch [INFO] Validating: publisher-discord [INFO] Validating: mesh-agent [INFO] Validating: nats-echo-req [INFO] Validating: nats-echo-res [INFO] Validating: publisher [INFO] Validating: analysis-echo [INFO] Validating: graph-linker [INFO] Validating: comfy-watcher [INFO] Validating: grayjay-plugin-host [INFO] Validating: agent-zero [INFO] Validating: archon [INFO] Validating: channel-monitor [INFO] Validating: pmoves-yt [INFO] Validating: notebook-sync [INFO] Validating: supabase_service_role_key [INFO] Validating: supabase_jwt_secret ====================================== |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
Updates Production Audit Checklist and Phase 3 after Firefly compose hardening (PR #981): - Docker hardening: Partial → GREEN - /healthz: MISSING → Partial (/api/v1/about probe) - env.shared: Unknown → GREEN - Phase 3 roadmap items struck through as completed Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 participant
Summary
docker-compose.external.ymlhad zero security hardening*tier-api-hardenedequivalent)Changes
Note
Uses
/api/v1/aboutas health probe (returns Firefly version, proves Laravel + DB are working). A custom/healthzendpoint would require upstream Firefly changes — tracked in TAC_WEALTH.md.Test plan
docker compose -f docker-compose.external.yml configvalidates YAMLdocker inspect pmoves-firefly | jq '.[0].HostConfig.CapDrop'shows["ALL"]🤖 Generated with Claude Code
Summary by CodeRabbit