fix: run Redis with image-supported privilege drop

compose.yaml

@@ -56,10 +56,13 @@ services:
       - /bin/sh
       - -ec
       - |
-        umask 077
+        chown redis:redis /data
-        printf 'appendonly yes\nappendfsync everysec\nmaxmemory 192mb\nmaxmemory-policy noeviction\nrequirepass %s\n' "$$REDIS_PASSWORD" > /tmp/redis.conf
+        exec /usr/bin/setpriv --reuid redis --regid redis --clear-groups \
-        chown redis:redis /data /tmp/redis.conf
+          /bin/sh -ec '
-        exec su-exec redis redis-server /tmp/redis.conf
+            umask 077
+            printf "appendonly yes\nappendfsync everysec\nmaxmemory 192mb\nmaxmemory-policy noeviction\nrequirepass %s\n" "$$REDIS_PASSWORD" > /data/redis.conf
+            exec redis-server /data/redis.conf
+          '
     volumes:
       - redis_data:/data
     networks: