feat(perception): stabilize pre-capture methodology

deploy/telemetry-plane/compose.yaml

@@ -10,6 +10,17 @@ services:
     image: eclipse-mosquitto:2.1.2-alpine
     container_name: ndc-mission-core-mqtt-broker
     restart: unless-stopped
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    cap_add:
+      - CHOWN
+      - SETGID
+      - SETUID
+    mem_limit: 128m
+    pids_limit: 128
     labels:
       <<: *ndc-labels
       com.nodedc.role: mqtt-broker
@@ -23,6 +34,8 @@ services:
       - ./runtime/mosquitto/passwords:/mosquitto/config/passwords:ro
       - ./runtime/mosquitto/acl:/mosquitto/config/acl:ro
       - broker-data:/mosquitto/data
+    tmpfs:
+      - /tmp:size=16m,noexec,nosuid
     healthcheck:
       test:
         - CMD-SHELL
@@ -38,6 +51,10 @@ services:
     image: timescale/timescaledb-ha:pg16.14-ts2.28.2-all-oss
     container_name: ndc-mission-core-telemetry-timescaledb
     restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    mem_limit: 1024m
+    pids_limit: 256
     labels:
       <<: *ndc-labels
       com.nodedc.role: telemetry-database
@@ -54,6 +71,34 @@ services:
       timeout: 5s
       retries: 10
 
+  database-bootstrap:
+    image: timescale/timescaledb-ha:pg16.14-ts2.28.2-all-oss
+    container_name: ndc-mission-core-telemetry-bootstrap
+    restart: "no"
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    mem_limit: 128m
+    pids_limit: 64
+    labels:
+      <<: *ndc-labels
+      com.nodedc.role: telemetry-database-bootstrap
+    depends_on:
+      timescale:
+        condition: service_healthy
+    environment:
+      MISSIONCORE_DB_NAME: "${MISSIONCORE_DB_NAME}"
+      MISSIONCORE_DB_ADMIN_USER: "${MISSIONCORE_DB_USER}"
+      MISSIONCORE_DB_ADMIN_PASSWORD: "${MISSIONCORE_DB_PASSWORD}"
+      MISSIONCORE_DB_INGEST_PASSWORD: "${MISSIONCORE_DB_INGEST_PASSWORD}"
+    volumes:
+      - ./timescale/002_roles_and_retention.sh:/bootstrap.sh:ro
+    tmpfs:
+      - /tmp:size=16m,noexec,nosuid
+    entrypoint: ["/bin/sh", "/bootstrap.sh"]
+
   normalizer:
     image: nodedc/mission-core-telemetry-normalizer:local
     container_name: ndc-mission-core-telemetry-normalizer
@@ -61,6 +106,13 @@ services:
       context: ../..
       dockerfile: deploy/telemetry-plane/normalizer/Dockerfile
     restart: unless-stopped
+    read_only: true
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    mem_limit: 256m
+    pids_limit: 128
     labels:
       <<: *ndc-labels
       com.nodedc.role: telemetry-normalizer
@@ -69,6 +121,8 @@ services:
         condition: service_healthy
       timescale:
         condition: service_healthy
+      database-bootstrap:
+        condition: service_completed_successfully
     ports:
       - "127.0.0.1:${MISSIONCORE_TELEMETRY_QUERY_PORT:-18030}:18030"
     environment:
@@ -77,9 +131,11 @@ services:
       MISSIONCORE_MQTT_USERNAME: "${MISSIONCORE_MQTT_INGEST_USER}"
       MISSIONCORE_MQTT_PASSWORD: "${MISSIONCORE_MQTT_INGEST_PASSWORD}"
       MISSIONCORE_DATABASE_DSN: >-
-        postgresql://${MISSIONCORE_DB_USER}:${MISSIONCORE_DB_PASSWORD}@timescale:5432/${MISSIONCORE_DB_NAME}
+        postgresql://missioncore_normalizer:${MISSIONCORE_DB_INGEST_PASSWORD}@timescale:5432/${MISSIONCORE_DB_NAME}
       MISSIONCORE_QUERY_HOST: "0.0.0.0"
       MISSIONCORE_QUERY_PORT: "18030"
+    tmpfs:
+      - /tmp:size=32m,noexec,nosuid
     healthcheck:
       test:
         - CMD