@@ -42,18 +42,17 @@ services:
     environment:
       - "MQUERY_PLUGINS=${MQUERY_PLUGINS}"
   ursadb:
-    build:
-      context: ursadb/
-      dockerfile: Dockerfile
+    image: mqueryci/ursadb:v1.5.0
     ports:
     - "9281:9281"
     volumes:
     - "${SAMPLES_DIR}:/mnt/samples"
     - "${INDEX_DIR}:/var/lib/ursadb"
+    user: "0:0"
   keycloak:
     image: quay.io/keycloak/keycloak:15.1.0
     ports:
-    - 8080:8080
+    - "8080:8080"
     environment:
     - KEYCLOAK_USER=admin
     - KEYCLOAK_PASSWORD=admin
 
@@ -39,14 +39,13 @@ services:
       - "redis"
       - "ursadb"
   ursadb:
-    build:
-      context: ursadb/
-      dockerfile: Dockerfile
+    image: mqueryci/ursadb:v1.5.0
     ports:
       - "9281:9281"
     volumes:
       - "./e2e-state/samples:/mnt/samples"
       - "./e2e-state/index:/var/lib/ursadb"
+    user: "0:0"
   redis:
     restart: always
     image: redis
@@ -31,14 +31,13 @@ services:
       - "MQUERY_PLUGINS=${MQUERY_PLUGINS}"
   ursadb:
     restart: always
-    build:
-      context: ursadb/
-      dockerfile: Dockerfile
+    image: mqueryci/ursadb:v1.5.0
     ports:
     - "127.0.0.1:9281:9281"
     volumes:
     - "${SAMPLES_DIR}:/mnt/samples"
     - "${INDEX_DIR}:/var/lib/ursadb"
+    user: "0:0"
   redis:
     restart: always
     image: redis
@@ -31,6 +31,9 @@ many things in mquery.
 
 ## Advanced topics 
 
+Relevant for people who want to run mquery in production or on a a bigger scale.
+
+- [Security](./security.md): Security considerations for hardening your mquery instance.
 - [Distributed mquery](./distributed.md): For users that want to run mquery on
     more than one machine.
 - [On-disk format](./ondiskformat.md): Read if you want to understand ursadb's on
 
@@ -0,0 +1,44 @@
+# security
+
+## Secure Deployment
+
+There are multiple components necessary to have a working Mquery instance.
+Some of them require special care from a security standpoint.
+
+### Mquery
+
+Mquery is a standard web application written in Python. By default, everyone has permission to do everything.
+This default configuration is unsuitable for bigger organisations or public instances.
+In such cases, it's recommended to enable user accounts (see [users.md](./users.md)),
+and disallow anonymous users or at least don't give them admin rights.
+
+### Mquery daemon (agent)
+
+No special considerations.
+
+### Redis
+
+Mquery web and daemon should have network access to Redis. No other access to
+the Redis database is necessary. There is no support for securing Redis with a password in the current version, so network isolation is the only way to
+prevent attacks. Most importantly, Redis must not be available from the
+public network.
+
+### Ursadb
+
+Mquery daemons must have network access to their respective ursadb instances.
+Similarly to Redis, it's best to restrict network access to the ursadb instance. Ursadb protocol does not take malicious actors into account, and
+unauthenticated users can, for example, remove indexed data from the database,
+or cause a denial of service.
+
+In the provided docker-compose files, the ursadb user is overridden to root by
+default. This is for
+backwards compatibility, and to simplify deployment. For production instances
+consider running ursadb with the default user (`ursa`, UID 1000). This means
+that the shared index volume must be writable by UID 1000, and samples must
+be readable by UID 1000.
+
+## How to report a vulnerability
+
+There is no dedicated email for reporting a security vulnerability. Please reach out
+to cert@cert.pl or one of the maintainers directly. If the vulnerability is not
+critical, the best way to report is via a GitHub issue.