Run Postgres unprivileged

Signed-off-by: Tommy <contact@tommytran.io>

docker-compose.yml

@@ -44,6 +44,14 @@ services:
       - ./schemas:/var/lib/postgresql/data:Z
     networks:
       - matrix
+    user: 70:70
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    tmpfs:
+      - /var/run/postgresql:size=50M,mode=0770,uid=70,gid=70,noexec,nosuid,nodev
 
   element:
     image: vectorim/element-web:latest