podman container hardening

[0xlua]

NixOS

There is a great overview with guides and additional resources to harden the base OS in the Wiki.

Basic Hardening

• Non-Root User: eg. user = “1000:100”
  • Advanced: user = "nobody:nogroup"
• drop capabilities, restart, read the error if it crashes, add back the minimum
  • run podman inspect (check capabilities: NET_RAW, SYS_CHROOT, MKNOD, ...)
  • add capabilities.ALL = false; to everything
  • Caddy, Vaultwarden, (maybe more) need NET_BIND_SERVICE for port 80/443
  • PostgreSQL: needs to chown data directories (CHOWN, SETUID, SETGID, ...)
• --security-opt=no-new-privileges
• read-only filesystem: --read-only
  • in addition some (e.g. PostgresQL) need --read-only-tmpfs=false (already default)
• make sure these are false, already default:
  • --privileged
  • --tty

Health checks

• replace "is the process alive" with real HTTP check
• each runtime needs its own approach:
  • Node: no curl, use Node's http module inline
  • Python slim: no curl, use urllib
  • Postgres: pg_isready just works

HTTP Headers

• set HSTS, CSP, ...
• check Security for each service: Mozilla Observatory

Secrets

• use sops for secrets
• when possible no plain-text env vars: prefer Files / Podman Secrets
• API Keys: Use scoped tokens where possible

Fix once

• use OIDC everywhere: 2FA/Passkeys
• use volumes only for data, move config to this flake: caddy-etc, stalwart-etc, ...

Reverse Proxy

• Use TLS 1.2 minimum, Restricted ciphers (already default in caddy).
• (Optional) switch to nginx and lego / certbot

Sources

• https://old.reddit.com/r/selfhosted/comments/1sqi04i/beyond_the_basics_what_are_your_nonnegotiable/
• https://old.reddit.comr/selfhosted/comments/1sgvwep/after_my_last_post_blew_up_i_audited_my_docker/

[0xlua]

Progress

I'll use this comment to track which containers have been hardened according to the checklist above. I'll also list container specific guides when available.

galileo

• Atuin: I need to update and want to migrate from Postgres to SQLite, Healthcheck
• Bore: Won't fix, since I want to switch anyways, see caddy: add l4 plugin #211
• Caddy: also block common malicious access patterns
• KitchenOwl: Healthcheck, also see KitchenOwl: disable username/password login #117
• Linkding: Healthcheck
• Littlelink: Healthcheck
• Miniflux: Healthcheck, see PostgreSQL
• Pocket ID
• rustypaste
• Stalwart: Healthcheck
• Upvote-RSS
• Vaultwarden

ganymede

• Jellyfin
• Calibre
• Mafl: everything read-only
• Paperless: also Redis -> Valkey
• HomeAssistant
• MusicAssistant
• Arr
  • Gluetun
  • Deluge: bind to tun0
  • FlareSolverr
  • Prowlarr
  • Radarr
  • Sonarr
  • Bazarr
• Caddy: Also use caddy inside LAN