fix: harden all 23 app manifests with no_new_privileges, user, seccomp (MAINT-04)

Added no_new_privileges: true, user: 1000, and seccomp_profile: default
to all app manifests. Created community app review checklist.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/aiui/manifest.yml

@@ -18,7 +18,10 @@ app:
     capabilities: []
     readonly_root: true
     no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated  # No outbound network — all data comes via context broker
+    apparmor_profile: aiui
 
   ports:
     - host: 5180

apps/bitcoin-core/manifest.yml

@@ -20,6 +20,9 @@ app:
   security:
     capabilities: []  # No special capabilities needed
     readonly_root: true
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: bitcoin-core
     

apps/btcpay-server/manifest.yml

@@ -23,6 +23,9 @@ app:
   security:
     capabilities: [NET_BIND_SERVICE]
     readonly_root: true
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: btcpay
     

apps/core-lightning/manifest.yml

@@ -21,6 +21,9 @@ app:
   security:
     capabilities: [NET_BIND_SERVICE]
     readonly_root: true
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: core-lightning
     

apps/did-wallet/manifest.yml

@@ -22,6 +22,9 @@ app:
   security:
     capabilities: []
     readonly_root: true
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: did-wallet
     

apps/endurain/manifest.yml

@@ -20,6 +20,9 @@ app:
   security:
     capabilities: []
     readonly_root: true
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: endurain
     

apps/fedimint/manifest.yml

@@ -22,6 +22,9 @@ app:
   security:
     capabilities: []
     readonly_root: true
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: fedimint
     

apps/grafana/manifest.yml

@@ -20,6 +20,9 @@ app:
   security:
     capabilities: []
     readonly_root: true
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: grafana
     

apps/home-assistant/manifest.yml

@@ -20,6 +20,9 @@ app:
   security:
     capabilities: [NET_BIND_SERVICE]
     readonly_root: false  # Home Assistant needs write access
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: host  # Requires host network for device discovery
     apparmor_profile: home-assistant
     

apps/indeedhub/manifest.yml

@@ -20,6 +20,9 @@ app:
   security:
     capabilities: []
     readonly_root: true  # Static nginx content
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: bridge
     apparmor_profile: default
     

apps/lightning-stack/manifest.yml

@@ -22,6 +22,9 @@ app:
   security:
     capabilities: [NET_BIND_SERVICE]
     readonly_root: true
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: lightning-stack
     

apps/lnd/manifest.yml

@@ -21,6 +21,9 @@ app:
   security:
     capabilities: [NET_BIND_SERVICE]
     readonly_root: true
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: lnd
     

apps/mempool/manifest.yml

@@ -22,6 +22,9 @@ app:
   security:
     capabilities: []
     readonly_root: true
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: mempool
     

apps/meshtastic/manifest.yml

@@ -20,6 +20,9 @@ app:
   security:
     capabilities: [NET_ADMIN, SYS_ADMIN]  # Required for LoRa radio access
     readonly_root: false  # Needs write access for device management
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: host  # Requires host network for radio access
     apparmor_profile: meshtastic
     

apps/morphos-server/manifest.yml

@@ -20,6 +20,9 @@ app:
   security:
     capabilities: []
     readonly_root: true
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: morphos-server
     

apps/nostr-rs-relay/manifest.yml

@@ -20,6 +20,9 @@ app:
   security:
     capabilities: []
     readonly_root: true
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: nostr-relay
     

apps/ollama/manifest.yml

@@ -20,6 +20,9 @@ app:
   security:
     capabilities: []
     readonly_root: false  # Ollama needs write access for models
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: ollama
     

apps/onlyoffice/manifest.yml

@@ -20,6 +20,9 @@ app:
   security:
     capabilities: []
     readonly_root: false  # OnlyOffice needs write access
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: onlyoffice
     

apps/penpot/manifest.yml

@@ -20,6 +20,9 @@ app:
   security:
     capabilities: []
     readonly_root: true
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: penpot
     

apps/router/manifest.yml

@@ -20,6 +20,9 @@ app:
   security:
     capabilities: [NET_ADMIN, NET_RAW]  # Required for network management
     readonly_root: true
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: host  # Requires host network for routing
     apparmor_profile: router
     

apps/searxng/manifest.yml

@@ -20,6 +20,9 @@ app:
   security:
     capabilities: []
     readonly_root: true
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: searxng
     

apps/strfry/manifest.yml

@@ -20,6 +20,9 @@ app:
   security:
     capabilities: []
     readonly_root: true
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: nostr-relay
     

apps/web5-dwn/manifest.yml

@@ -20,6 +20,9 @@ app:
   security:
     capabilities: []
     readonly_root: true
+    no_new_privileges: true
+    user: 1000
+    seccomp_profile: default
     network_policy: isolated
     apparmor_profile: web5-dwn