Ужесточить контейнеры сервисов

Прикладные образы работают non-root (deal, UID 10001, HOME=/tmp); в compose добавлены read_only root FS, tmpfs /tmp, no-new-privileges, cap_drop ALL и лимиты mem/cpus. Логи stateless-сервисов вынесены в /tmp/logs. Проверено compose config (dev/prod/observability).

deploy/compose.prod.yml

@@ -48,6 +48,17 @@
 # Frontend: статика монтируется из ../src/frontend/dist (СОБРАТЬ ДО ПОДЪЁМА: cd src/frontend &&
 # npm run build). Конфигурация caddy — deploy/caddy/Caddyfile (см. его шапку про домен/TLS).
 
+# Общий hardening прикладных сервисов (BL-IMG-HARDEN): read-only root FS + tmpfs /tmp,
+# запрет новых привилегий и сброс capabilities. Данные/логи — только в именованных volume или tmpfs.
+x-service-hardening: &service-hardening
+  read_only: true
+  tmpfs:
+    - /tmp
+  security_opt:
+    - no-new-privileges:true
+  cap_drop:
+    - ALL
+
 services:
   postgres:
     image: postgres:16-alpine
@@ -84,6 +95,9 @@ services:
     build:
       context: ..
       dockerfile: src/core/Deal.Api/Dockerfile
+    <<: *service-hardening
+    mem_limit: 1g
+    cpus: 1.5
     environment:
       ASPNETCORE_ENVIRONMENT: Production
       ASPNETCORE_URLS: http://0.0.0.0:5080
@@ -149,11 +163,15 @@ services:
     build:
       context: ..
       dockerfile: src/telegram-service/Deal.Telegram/Dockerfile
+    <<: *service-hardening
+    mem_limit: 512m
+    cpus: 1.0
     environment:
       GRPC_PORT: "5101"
       DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:?DEAL_SERVICE_TOKEN не задан}
       DEAL_TELEGRAM_SESSION_KEY: ${DEAL_TELEGRAM_SESSION_KEY:?DEAL_TELEGRAM_SESSION_KEY не задан (ключ AES-GCM сессий)}
       DEAL_TELEGRAM_SESSION_DIR: /data/sessions
+      DEAL_LOGS_DIR: /tmp/logs
       SERVICES__CORE__INGRESS: ${DEAL_CORE_INGRESS:-http://core:5082}
       DEAL_MTLS_ENABLED: ${DEAL_MTLS_ENABLED:-0}
       DEAL_MTLS_CA_PEM: /etc/deal/certs/ca.pem
@@ -176,9 +194,13 @@ services:
     build:
       context: ..
       dockerfile: src/ai-service/Deal.Ai/Dockerfile
+    <<: *service-hardening
+    mem_limit: 512m
+    cpus: 1.0
     environment:
       GRPC_PORT: "5102"
       DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:?DEAL_SERVICE_TOKEN не задан}
+      DEAL_LOGS_DIR: /tmp/logs
       DEAL_MTLS_ENABLED: ${DEAL_MTLS_ENABLED:-0}
       DEAL_MTLS_CA_PEM: /etc/deal/certs/ca.pem
       DEAL_MTLS_SERVER_CERT_PFX: /etc/deal/certs/ai-service-server.pfx
@@ -199,10 +221,14 @@ services:
     build:
       context: ..
       dockerfile: src/ml-service/Deal.Ml/Dockerfile
+    <<: *service-hardening
+    mem_limit: 768m
+    cpus: 1.0
     environment:
       GRPC_PORT: "5103"
       DEAL_SERVICE_TOKEN: ${DEAL_SERVICE_TOKEN:?DEAL_SERVICE_TOKEN не задан}
       DEAL_ML_DATA_DIR: /data/ml
+      DEAL_LOGS_DIR: /tmp/logs
       DEAL_MTLS_ENABLED: ${DEAL_MTLS_ENABLED:-0}
       DEAL_MTLS_CA_PEM: /etc/deal/certs/ca.pem
       DEAL_MTLS_SERVER_CERT_PFX: /etc/deal/certs/ml-service-server.pfx