Ужесточить контейнеры сервисов

Прикладные образы работают non-root (deal, UID 10001, HOME=/tmp); в compose добавлены read_only root FS, tmpfs /tmp, no-new-privileges, cap_drop ALL и лимиты mem/cpus. Логи stateless-сервисов вынесены в /tmp/logs. Проверено compose config (dev/prod/observability).

deploy/compose.dev.yml

@@ -26,6 +26,17 @@
 # dotnet run, и сервисы ходят в ингресс хоста через DEAL_CORE_INGRESS=http://host.docker.internal:5082
 # (см. env telegram-service ниже).
 
+# Общий hardening прикладных сервисов (BL-IMG-HARDEN): read-only root FS + tmpfs /tmp,
+# запрет новых привилегий и сброс capabilities. Данные — только в именованных volume.
+x-service-hardening: &service-hardening
+  read_only: true
+  tmpfs:
+    - /tmp
+  security_opt:
+    - no-new-privileges:true
+  cap_drop:
+    - ALL
+
 services:
   postgres:
     image: postgres:16-alpine
@@ -72,6 +83,9 @@ services:
       context: ..
       dockerfile: src/core/Deal.Api/Dockerfile
     container_name: deal-core
+    <<: *service-hardening
+    mem_limit: 1g
+    cpus: 1.5
     environment:
       ASPNETCORE_ENVIRONMENT: Development
       ASPNETCORE_URLS: http://0.0.0.0:5080
@@ -123,11 +137,15 @@ services:
       context: ..
       dockerfile: src/telegram-service/Deal.Telegram/Dockerfile
     container_name: deal-telegram-service
+    <<: *service-hardening
+    mem_limit: 512m
+    cpus: 1.0
     environment:
       GRPC_PORT: "5101"
       DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:-deal_dev_service_token}
       DEAL_TELEGRAM_SESSION_KEY: ${DEAL_TELEGRAM_SESSION_KEY:-ZmVkY2JhOTg3NjU0MzIxMGZlZGNiYTk4NzY1NDMyMTA=}
       DEAL_TELEGRAM_SESSION_DIR: /data/sessions
+      DEAL_LOGS_DIR: /tmp/logs
       SERVICES__CORE__INGRESS: ${DEAL_CORE_INGRESS:-http://core:5082}
     ports:
       - "5101:5101"
@@ -151,9 +169,13 @@ services:
       context: ..
       dockerfile: src/ai-service/Deal.Ai/Dockerfile
     container_name: deal-ai-service
+    <<: *service-hardening
+    mem_limit: 512m
+    cpus: 1.0
     environment:
       GRPC_PORT: "5102"
       DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:-deal_dev_service_token}
+      DEAL_LOGS_DIR: /tmp/logs
     ports:
       - "5102:5102"
     healthcheck:
@@ -173,10 +195,14 @@ services:
       context: ..
       dockerfile: src/ml-service/Deal.Ml/Dockerfile
     container_name: deal-ml-service
+    <<: *service-hardening
+    mem_limit: 768m
+    cpus: 1.0
     environment:
       GRPC_PORT: "5103"
       DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:-deal_dev_service_token}
       DEAL_ML_DATA_DIR: /data/ml   # файлы моделей data/ml/<tenantId>.sqlite на volume deal_ml_data (Ruling 4/12)
+      DEAL_LOGS_DIR: /tmp/logs
     ports:
       - "5103:5103"
     volumes:
@@ -195,6 +221,9 @@ services:
       context: ..
       dockerfile: src/storage-service/Deal.Storage/Dockerfile
     container_name: deal-storage-service
+    <<: *service-hardening
+    mem_limit: 512m
+    cpus: 1.0
     environment:
       GRPC_PORT: "5104"
       DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:-deal_dev_service_token}
@@ -203,6 +232,7 @@ services:
       DEAL_STORAGE_SECRET_KEY: deal_minio_secret
       DEAL_STORAGE_BUCKET: deal-attachments
       DEAL_STORAGE_SECURE: "false"
+      DEAL_LOGS_DIR: /tmp/logs
     ports:
       - "5104:5104"
     depends_on: