test: drop all Linux kernel capabilities (#89)

Author: Djaytan

src/localdev.sh

@@ -1,11 +1,11 @@
 #!/usr/bin/env sh
-# TODO: OWASP RULE#3 https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-3-limit-capabilities-grant-only-specific-capabilities-needed-by-a-container
 # TODO: OWASP RULE#4 https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-4-prevent-in-container-privilege-escalation
 # TODO: OWASP RULE#7 https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-7-limit-resources-memory-cpu-file-descriptors-processes-restarts
 # TODO: Same OWASP rules in test.sh file
 # TODO: document security recommendations adapted to this project
 # TODO: document requirements for OWASP RULE#8 https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-7-limit-resources-memory-cpu-file-descriptors-processes-restarts
 # TODO: try OWASP RULE#8 here
+# TODO: move at root of the project
 
 set -eu
 
@@ -19,5 +19,11 @@ docker buildx bake --progress=plain dev
 echo '✅  Image built successfully.'
 
 echo '▶️ Starting the localdev PaperMC server...'
-docker run --rm -it -p 25565:25565/tcp -p 25565:25565/udp -e EULA=true 'djaytan/papermc-server:dev'
+
+docker run --rm -it \
+  --cap-drop all \
+  -p 25565:25565/tcp -p 25565:25565/udp \
+  -e EULA=true \
+  'djaytan/papermc-server:dev'
+
 echo '🛑 The localdev PaperMC server has been stopped and removed.'

src/test/docker/test.sh

@@ -8,7 +8,12 @@ CONTAINER_NAME='test-papermc-server'
 echo '📋 Testing the Docker PaperMC server image...'
 
 echo '▶️ Starting the PaperMC server in background...'
-docker run --rm -d --name "$CONTAINER_NAME" -e EULA=true 'djaytan/papermc-server:dev'
+
+docker run --rm -d --name "$CONTAINER_NAME" \
+  --cap-drop all \
+  -p 25565:25565/tcp -p 25565:25565/udp \
+  -e EULA=true \
+  'djaytan/papermc-server:dev'
 
 cleanup() {
     echo '🛑 Automatically stopping and removing the PaperMC server container...'