feat: increased security

docker-compose.yml

@@ -19,6 +19,14 @@ services:
       - SERVER_PORT=${SERVER_PORT}
       - REDIS_URL=${REDIS_URL}
     restart: unless-stopped
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+    deploy:
+      resources:
+        limits:
+          memory: 256M
+          cpus: '0.50'
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://localhost:8080/ping"]
       interval: 5s
@@ -27,15 +35,25 @@ services:
       start_period: 10s
 
   redis:
-    image: redis:latest
+    image: redis:7.4-alpine
     container_name: link-shortener-redis
     networks: [isolated]
     restart: unless-stopped
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+    deploy:
+      resources:
+        limits:
+          memory: 256M
+          cpus: '0.50'
     volumes:
       - redis_data:/data
-    command: ["redis-server", "--appendonly", "yes"]
+    tmpfs:
+      - /tmp
+    command: ["redis-server", "--appendonly", "yes", "--requirepass", "${REDIS_PASSWORD}"]
     healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
+      test: ["CMD", "redis-cli", "-a", "${REDIS_PASSWORD}", "ping"]
       interval: 5s
       timeout: 3s
       retries: 5
@@ -49,4 +67,4 @@ networks:
   isolated:
     driver: bridge
   proxy:
-    external: true
+    external: true