AttackSurfaceAnalyzer VS redis-docker

Solid comments here, on the client side you might like MS Attack Surface Monitor. https://github.com/microsoft/AttackSurfaceAnalyzer

Also take a look at MS attack surface anaylzer it has similar and additional capabilities. https://github.com/microsoft/attacksurfaceanalyzer

Maybe try Attack Surface Analyzer as well.

Basically, anything is better than giving local admin, even if you have to give Domain Users full control to the app folder(s) and reg keys. The tricky part is finding the required perms but home grown apps are usually pretty simple. An app like Attack Surface Analyzer may be able to help. Or just run the app as a standard user and use a tool like ProcMon to find the denied locations. I would probably first loosen up the ACL on the Program Files folder and that alone often fixes it.

version: "3.7" services: postgres: image: "postgres:14-alpine" environment: POSTGRES_USER: "example" POSTGRES_PASSWORD: "example" ports: - "5432:5432" volumes: - "postgres:/var/lib/postgresql/data" redis: image: "redis:5-alpine" command: ["redis-server", "--requirepass", "yourpassword", "--appendonly", "yes"] healthcheck: test: ["CMD", "redis-cli", "ping"] interval: 10s timeout: 5s retries: 5 ports: - "6379:6379" volumes: - redis:/data sysctls: # https://github.com/docker-library/redis/issues/35 net.core.somaxconn: "511" sidekiq: depends_on: - "postgres" - "redis" - "elasticsearch" build: context: . args: environment: development image: you/yourapp command: bundle exec sidekiq -C config/sidekiq.yml.erb volumes: - ".:/app" # don"t mount tmp directory - /app/tmp env_file: - ".env" web: build: context: . args: environment: development image: you/yourapp command: bundle exec rspec depends_on: elasticsearch: condition: service_healthy postgres: condition: service_started redis: condition: service_healthy tty: true stdin_open: true ports: - "3000:3000" env_file: - ".env" elasticsearch: container_name: elasticsearch image: docker.elastic.co/elasticsearch/elasticsearch:7.4.2 environment: - discovery.type=single-node - cluster.name=docker-cluster - bootstrap.memory_lock=true - "ES_JAVA_OPTS=-Xms1024m -Xmx1024m" - "logger.org.elasticsearch=error" healthcheck: test: curl --fail elasticsearch:9200/_cat/health >/dev/null || exit 1 interval: 30s timeout: 10s retries: 5 ulimits: memlock: soft: -1 hard: -1 volumes: - esdata:/usr/share/elasticsearch/data ports: - 9200:9200 volumes: redis: postgres: esdata:

I was caught out by this too[0]. I now have a fw script which runs automatically for demos etc.

[0] https://github.com/docker-library/redis/issues/259#issuecomm...

Short hack: As seen in m a n y Dockerfiles, the apt cache is located at /var/lib/apt/lists.