build: add hardened Compose contract

compose.yaml

@@ -0,0 +1,30 @@
+services:
+  site:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    user: "101:101"
+    read_only: true
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    expose:
+      - "8080"
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=16m
+      - /var/cache/nginx:rw,noexec,nosuid,size=16m
+      - /var/run:rw,noexec,nosuid,size=16m
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - wget -qO- http://127.0.0.1:8080/health.json || exit 1
+      interval: 10s
+      timeout: 2s
+      retries: 3
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "0.50"
+          memory: 64MiB

tests/test_compose_contract.py

@@ -81,7 +81,7 @@ class ComposeContract(unittest.TestCase):
         if not COMPOSE_FILE.is_file():
             raise AssertionError(f"RED: required Compose file is missing: {COMPOSE_FILE}")
         rendered = run(
-            [COMPOSE_BIN, "compose", "-f", str(COMPOSE_FILE), "config", "--format", "json"]
+            [COMPOSE_BIN, "-f", str(COMPOSE_FILE), "config", "--format", "json"]
         )
         if rendered.returncode != 0:
             raise AssertionError(f"Compose config rendering failed:\n{rendered.stderr}")