[Security] Fix HIGH vulnerability: yaml.docker-compose.security.writable-filesystem-service.writable-filesystem-service (#1005)

Co-authored-by: orbisai0security <[email protected]>
Co-authored-by: houseme <[email protected]>

docker-compose.yml

@@ -196,6 +196,8 @@ services:
 
   # NGINX reverse proxy (optional)
   nginx:
+    security_opt:
+      - "no-new-privileges:true"
     image: nginx:alpine
     container_name: nginx-proxy
     ports:
@@ -204,9 +206,14 @@ services:
     volumes:
       - ./.docker/nginx/nginx.conf:/etc/nginx/nginx.conf:ro
       - ./.docker/nginx/ssl:/etc/nginx/ssl:ro
+    tmpfs:
+      - /var/run
+      - /var/cache/nginx
+      - /var/log/nginx
     networks:
       - rustfs-network
     restart: unless-stopped
+    read_only: true
     profiles:
       - proxy
     depends_on: