Update Photography_Containers/immich/compose.yaml

Photography_Containers/immich/compose.yaml

@@ -2,7 +2,7 @@
 # Make sure to use the docker-compose.yml of the current release:
 # https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml
 name: immich
-    
+
 services:
   immich-server:
     container_name: immich_server
@@ -10,6 +10,8 @@ services:
     # extends:
     #   file: hwaccel.transcoding.yml
     #   service: cpu # set to one of [nvenc, quicksync, rkmpp, vaapi, vaapi-wsl] for accelerated transcoding
+    security_opt:
+      - no-new-privileges:true
     volumes:
       # Do not edit the next line. If you want to change the media storage location on your system, edit the value of UPLOAD_LOCATION in the .env file
       - ${UPLOAD_LOCATION}:/data
@@ -23,8 +25,10 @@ services:
     #ports:
      # - '5009:2283'
     depends_on:
-      - redis
-      - database
+      redis:
+        condition: service_healthy
+      database:
+        condition: service_healthy
     healthcheck:
       disable: false
     networks:
@@ -61,6 +65,15 @@ services:
     # extends: # uncomment this section for hardware acceleration - see https://docs.immich.app/features/ml-hardware-acceleration
     #   file: hwaccel.ml.yml
     #   service: cpu # set to one of [armnn, cuda, rocm, openvino, openvino-wsl, rknn] for accelerated inference - use the `-wsl` version for WSL2 where applicable
+    security_opt:
+      - no-new-privileges:true
+    deploy:
+      resources:
+        limits:
+          cpus: '4'
+          memory: 4G
+        reservations:
+          memory: 1G
     volumes:
       - /srv/docker/immich/model-cache:/cache
     env_file:
@@ -74,6 +87,8 @@ services:
   redis:
     container_name: immich_redis
     image: docker.io/valkey/valkey:9@sha256:546304417feac0874c3dd576e0952c6bb8f06bb4093ea0c9ca303c73cf458f63
+    security_opt:
+      - no-new-privileges:true
     healthcheck:
       test: redis-cli ping || exit 1
     restart: unless-stopped
@@ -83,6 +98,8 @@ services:
   database:
     container_name: immich_postgres
     image: ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0@sha256:bcf63357191b76a916ae5eb93464d65c07511da41e3bf7a8416db519b40b1c23
+    security_opt:
+      - no-new-privileges:true
     environment:
       # Comment out DB_Password and uncomment POSTGRES_PASSWORD if using DB_Password stored in the .env file. This is needed for Dockhand for passing in the secret
       DB_PASSWORD: