komga + audiobookshelf: add no-new-privileges (root-fallback hardening)

Address security review: reverting to root removed the user:1000 boundary, so add
security_opt no-new-privileges:true to block SUID-based escalation. Full cap_drop
is intentionally NOT applied — the images' root-init needs CHOWN/SETUID/SETGID to
set up /config and /metadata (dropping them reproduces the crash we hit at user:1000).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

templates/audiobookshelf/docker-compose.yml

@@ -20,6 +20,11 @@ services:
     image: ghcr.io/advplyr/audiobookshelf:2.19.5
     container_name: audiobookshelf
     restart: unless-stopped
+    # Runs as root (see note above). Restore an escalation boundary: block SUID-based privilege
+    # escalation. Full cap_drop is NOT applied — the image's root-init needs file-ownership caps to
+    # set up /metadata, and dropping them reproduces the EACCES failure we hit pinning user:1000.
+    security_opt:
+      - no-new-privileges:true
     environment:
       - TZ=Europe/Budapest
     volumes:

templates/komga/docker-compose.yml

@@ -19,6 +19,11 @@ services:
     image: gotson/komga:1.20.0
     container_name: komga
     restart: unless-stopped
+    # Runs as root (see note above). Restore an escalation boundary: block SUID-based privilege
+    # escalation. Full cap_drop is NOT applied — the image's root-init needs CHOWN/SETUID/SETGID to
+    # set up /config, and dropping them crash-loops it (the same failure we hit pinning user:1000).
+    security_opt:
+      - no-new-privileges:true
     environment:
       - TZ=Europe/Budapest
     volumes: