CooperandGoodman/bourbonacci
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Pin image digests and disable TRACE method in nginx

Browse Source 
- nginx and mysql images pinned to SHA256 digests
- nginx: return 405 on TRACE requests

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Derek Cooper
2026-05-25 01:20:18 -07:00
parent e08e031ad0
commit 84b07e33e7
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker-compose.yml
+2 -2
View File
@@ -1,6 +1,6 @@
services: services:
nginx: nginx:
image: nginx:alpine image: nginx:alpine@sha256:4001b8091adb507866f42c251759b40290995629415d46684a32d3ede850c976
ports: ports:
- "8057:80" - "8057:80"
volumes: volumes:
@@ -37,7 +37,7 @@ services:
start_period: 30s start_period: 30s
db: db:
image: mysql:8 image: mysql:8@sha256:c36050afdca850f23cef85703f84c7531a5ae155a11b5ee1c60acb09937c4084
environment: environment:
- MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD} - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
- MYSQL_DATABASE=${MYSQL_DATABASE} - MYSQL_DATABASE=${MYSQL_DATABASE}
nginx/default.conf
+4
View File
@@ -17,6 +17,10 @@ server {
add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self';" always; add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self';" always;
if ($request_method = TRACE) {
return 405;
}
location / { location / {
try_files $uri $uri/ /index.html; try_files $uri $uri/ /index.html;
} }