HARDN_DOCKER/docker-compose.yml at main · Security-International-Group/HARDN_DOCKER · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
services:
  hardn-xdr:
    build:
      context: .
      dockerfile: Dockerfile
    image: hardn-xdr:latest
    container_name: hardn_docker
    restart: on-failure:5
    user: "10001:10001"

    # Resource limits (CIS 5.10, 5.11, 5.28)
    mem_limit: 512m
    mem_reservation: 256m
    cpu_shares: 1024
    cpu_quota: 100000
    cpu_period: 100000
    pids_limit: 1024

    # Security and isolation (CIS 5.1, 5.2, 5.3, 5.25)
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add: []  # No capabilities added to avoid CIS warnings
    read_only: true
    tmpfs:
      - /tmp:rw,noexec,nosuid,size=64m,mode=1777
      - /run:rw,noexec,nosuid,size=16m,mode=0755
      - /home/hardn:rw,size=32m,mode=0755
      - /var/lib/hardn:rw,size=32m,mode=0755
    # Per-container network namespace sysctls (CIS 3.x / NIST SP 800-190)
    # kernel.* and fs.* sysctls require privileged mode and are set by the host.
    # net.* scoped to the container's own network namespace and safe without privileges.
    sysctls:
      net.ipv4.conf.all.accept_redirects: 0
      net.ipv4.conf.default.accept_redirects: 0
      net.ipv4.conf.all.accept_source_route: 0
      net.ipv4.conf.default.accept_source_route: 0
      net.ipv4.conf.all.log_martians: 1
      net.ipv4.conf.default.log_martians: 1
      net.ipv4.conf.all.rp_filter: 1
      net.ipv4.icmp_echo_ignore_broadcasts: 1
      net.ipv4.icmp_ignore_bogus_error_responses: 1
      net.ipv4.tcp_syncookies: 1
    # Do not share the host user namespace; sharing causes bench warnings.
    # Removing `userns_mode: host` avoids exposing host UID/GID mappings to the container.
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: 3
    #######################################################
    # Volumes for persistent data (ROFS)
    volumes:
      - ./logs:/opt/hardn-xdr/state:rw
      - ./config:/opt/hardn-xdr/config:ro
    #######################################################
    environment:
      - TZ=UTC
      - LANG=C.UTF-8
      - LC_ALL=C.UTF-8
      - DOCKER_MEMORY_LIMIT=512m
      - DOCKER_CPU_SHARES=1024
      - MALLOC_ARENA_MAX=1
      - DOCKER_CONTENT_TRUST=1
      - OPENSSL_FIPS=1
      - FIPS_MODE=1

    # Health check (CIS 5.26)
    healthcheck:
      test: ["CMD", "/usr/local/bin/health_check.sh"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

    # No ports are published by the hardened base image: it ships no listening
    # service (python3 is purged, so the Flask dashboard in src/app.py does not
    # run here). Publish a port only in an extension layer that adds a service,
    # and bind it to loopback, e.g.:
    #   ports:
    #     - "127.0.0.1:8082:5000"

    labels:
      - "project=hardn-xdr"
      - "version=1.0"
      - "security.level=high"
      - "compliance=cis-1.13.0,fips-140-3-aligned"
      - "security.apparmor=host-enforced"
      - "security.selinux=host-enforced"
      - "security.fips.140-3=aligned"
      - "security.nist.sp800-52=rev2-compliant"
      - "security.readonly.rootfs=true"
      - "security.no.new.privileges=true"
      - "security.capabilities=restricted"

    # Isolated user-defined network (bench 2.1)
    networks:
      - hardn_net

networks:
  hardn_net:
    driver: bridge
    driver_opts:
      com.docker.network.bridge.enable_icc: "false"
    internal: false