fix: run Redis with image-supported privilege drop

compose.yaml

@@ -56,10 +56,13 @@ services:
       - /bin/sh
       - -ec
       - |
+        chown redis:redis /data
+        exec /usr/bin/setpriv --reuid redis --regid redis --clear-groups \
+          /bin/sh -ec '
             umask 077
-        printf 'appendonly yes\nappendfsync everysec\nmaxmemory 192mb\nmaxmemory-policy noeviction\nrequirepass %s\n' "$$REDIS_PASSWORD" > /tmp/redis.conf
+            printf "appendonly yes\nappendfsync everysec\nmaxmemory 192mb\nmaxmemory-policy noeviction\nrequirepass %s\n" "$$REDIS_PASSWORD" > /data/redis.conf
-        chown redis:redis /data /tmp/redis.conf
+            exec redis-server /data/redis.conf
-        exec su-exec redis redis-server /tmp/redis.conf
+          '
     volumes:
       - redis_data:/data
     networks: