container: more read-only volumes (#275)

Reviewed-on: #275
Co-authored-by: Michael Grote <michael.grote@posteo.de>
Co-committed-by: Michael Grote <michael.grote@posteo.de>

docker-compose/act-runner/docker-compose.yml.j2

@@ -15,7 +15,7 @@ services:
       - no-new-privileges=true
     volumes:
       - act_runner_data:/data
-      - ./config.yml:/config.yml
+      - ./config.yml:/config.yml:ro
       - /var/run/docker.sock:/var/run/docker.sock
     environment:
       GITEA_INSTANCE_URL: https://git.mgrote.net

docker-compose/authelia/docker-compose.yml.j2

@@ -17,8 +17,7 @@ services:
     environment:
       TZ: Europe/Berlin
     volumes:
-      - ./configuration.yml:/config/configuration.yml
-      - ./users_database.yml:/config/users_database.yml
+      - ./configuration.yml:/config/configuration.yml:ro
       - authelia_data:/data
     labels:
       traefik.enable: true

docker-compose/lldap/docker-compose.yml.j2

@@ -15,8 +15,8 @@ services:
       - "3890:3890"
       - "17170:17170" # front-end
     volumes:
-      - "lldap_data:/data"
-      - "./lldap_config.toml:/data/lldap_config.toml"
+      - lldap_data:/data
+      - ./lldap_config.toml:/data/lldap_config.toml:ro
     environment:
       TZ: Europe/Berlin
     networks:

docker-compose/miniflux/docker-compose.yml.j2

@@ -87,7 +87,7 @@ services:
       #MF_DEBUG: 1
     image: "registry.mgrote.net/miniflux-filter:latest"
     volumes:
-      - ./filter.txt:/data/filter.txt
+      - ./filter.txt:/data/filter.txt:ro
     networks:
       - internal
 

docker-compose/traefik/docker-compose.yml.j2

@@ -16,8 +16,8 @@ services:
       - no-new-privileges=true
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock:ro
-      - ./traefik.yml:/etc/traefik/traefik.yml
-      - ./file-provider.yml:/etc/traefik/file-provider.yml
+      - ./traefik.yml:/etc/traefik/traefik.yml:ro
+      - ./file-provider.yml:/etc/traefik/file-provider.yml:ro
       - acme_data:/etc/traefik/acme
     networks:
       - traefik

docker-compose/wiki/docker-compose.yml.j2

@@ -16,7 +16,7 @@ services:
     ports:
       - 8087:80
     volumes:
-      - /docker/wiki/site/site:/usr/local/apache2/htdocs/
+      - /docker/wiki/site/site:/usr/local/apache2/htdocs/:ro
       # /docker/wiki/site/site ist ein lokales Verzeichnis auf docker10
       # dieser Verzeichnis wird direkt in der Wiki CI gemountet
       # und die Daten werden dort reingeschrieben