Add seccomp/AppArmor profiles and container hardening

[PeaStew]

Summary

Docker containers run without security profiles, read-only filesystems, or capability dropping in docker-compose.yml. While the containers do correctly run as non-root users (appuser/node), additional hardening is missing.

Recommendation

Add to each service in docker-compose.yml:

security_opt:
  - no-new-privileges:true
  - seccomp:default
read_only: true
tmpfs:
  - /tmp
cap_drop:
  - ALL

Also consider:

• Using --memory and --cpus limits to prevent resource exhaustion
• Enabling Docker Content Trust for image verification