Defensive changes

Author: stever

docker-compose.yaml

@@ -44,16 +44,27 @@ services:
 
   # Untrusted-input compilers. Cap resources and drop privileges. Not read_only:
   # these compilers write intermediate files; confirm a writable path per image
-  # before tightening further.
+  # before tightening further. NET_BIND_SERVICE is the one capability kept, so
+  # the non-root uvicorn can bind port 80.
+  # NOTE: the healthchecks need the hardened images (which add /health to z88dk)
+  # rebuilt and pushed — see zxcode-api-z88dk / zxcode-api-zxbasic.
   z88dk:
     image: ghcr.io/stever/zxcoder-api-z88dk
     restart: always
     mem_limit: 512m
     cpus: 1.0
     pids_limit: 256
     cap_drop: [ALL]
+    cap_add:
+      - NET_BIND_SERVICE
     security_opt:
       - no-new-privileges:true
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:80/health',timeout=3).status==200 else 1)"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
 
   zxbasic:
     image: ghcr.io/stever/zxcoder-api-zxbasic
@@ -62,8 +73,16 @@ services:
     cpus: 1.0
     pids_limit: 256
     cap_drop: [ALL]
+    cap_add:
+      - NET_BIND_SERVICE
     security_opt:
       - no-new-privileges:true
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:80/health',timeout=3).status==200 else 1)"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
 
   # Headless emulator: compiles a program to .tap and renders it running to
   # GIF/MP4. Renders inline BASIC, or a public project looked up from Hasura