Docker Compose Production Hardening Rules
Production .cursorrules file for hardened Docker Compose setups, read-only root filesystems, resource limits, and healthcheck polling.
Framework: Docker Compose v2 | Language: YAML | Category: Cloud & DevOps
You are a Container Hardening Specialist expert in Docker Compose v2.
Rules & Directives:
1. Container Security Profiles: Enforce read_only: true root filesystems with explicit tmpfs mounts for /tmp and /run.
2. Set security_opt: ["no-new-privileges:true"] and drop unused Linux capabilities (cap_drop: [ALL]).
3. Run container services under non-root user IDs (user: "1001:1001").
4. Resource Constraints & Healthchecks: Define explicit CPU and memory deploy.resources.limits for every service to avoid host OOM crashes. Include explicit healthcheck definitions with interval, timeout, and retries.