Docker Security Overhaul: Dropping capabilities

[josecelano]

Remove capabilities from services with:

    cap_drop:
      - ALL

For example:

# docker-compose.yaml
version: "3.8"

services:
  db:
    image: mysql:latest
    container_name: db
    env_file:
      - .env
    restart: unless-stopped
    privileged: false
    user: "1000:1000"
    cap_drop:
      - ALL
    ports:
      - "3306:3306"
    volumes:
      - ./tmp:/tmp
      - ./mysqld:/var/run/mysqld/