Update docker-compose

[MemQu]

Describe the feature you'd like

version: "3.8"
services:
  web:
    image: ghcr.io/karakeep-app/karakeep:${KARAKEEP_VERSION:-release}
    restart: unless-stopped
    container_name: Hoarder
    volumes:
      # By default, the data is stored in a docker volume called "data".
      # If you want to mount a custom directory, change the volume mapping to:
      # - /path/to/your/directory:/data
      - ./data:/data
    ports:
      - 3000:3000
    env_file:
      - .env
    environment:
      MEILI_ADDR: http://meilisearch:7700
      BROWSER_WEB_URL: http://chrome:9222
      # OPENAI_API_KEY: ...

      # You almost never want to change the value of the DATA_DIR variable.
      # If you want to mount a custom directory, change the volume mapping above instead.
      DATA_DIR: /data # DON'T CHANGE THIS
  chrome:
    image: gcr.io/zenika-hub/alpine-chrome:124
    restart: unless-stopped
    container_name: hoarder_1
    security_opt:
      - seccomp:./chrome.json
    command:
      - --disable-gpu
      - --disable-dev-shm-usage
      - --remote-debugging-address=0.0.0.0
      - --remote-debugging-port=9222
      - --hide-scrollbars
  meilisearch:
    image: getmeili/meilisearch:v1.11.1
    restart: unless-stopped
    container_name: hoarder_2
    env_file:
      - .env
    environment:
      MEILI_NO_ANALYTICS: "true"
    volumes:
      - ./meilisearch:/meili_data

(Enable sandbox and apply security policies)
Upgrade chromium to 124, use security_opt as recommended in Alpine Chromium repo

Use chrome.json from here:

chrome.json

Describe the benefits this would bring to existing Hoarder users

Sandboxing

Can the goal of this request already be achieved via other means?

Idk

Have you searched for an existing open/closed issue?

• I have searched for existing issues and none cover my fundamental request

Additional context

No response

[Zoobdude]

The Alpine Chromium repo seems to be a bit abandoned - the GitHub actions build has been failing for the last 5 months https://github.com/jlandure/alpine-chrome/actions and it's very unclear where this 124 image has come from, as it doesn't seem to have been the GH action. So while it is far from ideal to use the current out of date 123 build. I think we need to ensure the source of this build + that regualr builds are still being made.

[stefnats]

If I may contribute another aspect: that chrome image is failing to start on the Oracle Cloud Always Free Tier ARM Servers and I think it's related to the cpu architecture (I guess arm64).

So yes, a better image would be helpful.

[Zoobdude]

I'm going to fork the repository and start making builds myself. I'll add the arm64 arch to the build command while I'm at it.

[gilbrotheraway]

I'm going to fork the repository and start making builds myself. I'll add the arm64 arch to the build command while I'm at it.

can't we use this one instead?
https://github.com/dgtlmoon/sockpuppetbrowser
runs fine on arm64