The official rootless Compose configuration already runs the Immich containers as 1000:1000, enables no-new-privileges and drops NET_RAW. I have been running the rootless configuration with additio...

compose-lint is a Docker Compose linter focused on security. It tells you exactly what's wrong with a Compose file and exactly how to fix it — every rule…

I wrote a lil tool that goes through a Docker Compose file and for each bind mount, creates the folder on the host with correct permissions. The only thing you'll have to do is tell it about the desired state: volumes: - type: bind source: /opt/test2 target: /foo x-setup: 1000:1000:700 # uid:gid:mode https://codeberg.org/larsrh/docker-bindmount-setup

Resolves #151 I tested this locally: $ cat /tmp/knot.yml network: listen: - interface: 0.0.0.0 port: 5353 $ sudo docker build -t knot-resolver:lars . # this used to crash $ sudo dock...

Central Bank Digital Currencies (CBDCs) support the creation of a resilient and inclusive digital payment ecosystem. We investigate the role of offline-capable CBDCs in ensuring universal access to financial services, especially in times of crisis when conventional...

@lars@hupel.info A quick note if anyone is taking this suggestion. The way this flag works is that instead of failing up front, Valkey will try to parse the RDB file and might fail if it encounters something it doesn't know later (most likely hash field expiration code). This is a late binding failure, instead of the upfront one.