cxff bridge hardening

sites/labs/src/content/docs/cheerpx-for-flash/20-native-bridge/index.md

@@ -123,6 +123,29 @@ Add the token to `bridgeURL` as the `token` query parameter:
 
 The bridge checks the token only when the connection opens, so a token only needs to stay valid until the page has loaded the Flash content. Connections with a missing, invalid or expired token are rejected with HTTP status 403.
 
+## How do I run the Native Bridge with the least privileges?
+
+From version 43, the Native Bridge can run under an unprivileged user in the container.
+Here is an example of a minimally privileged setup:
+
+```sh
+docker run --init --rm \
+  -p 28083:28083 \
+  --user 65534:65534 \
+  --read-only -v /tmp \
+  --cap-drop=ALL --security-opt=no-new-privileges \
+  -v /path/to/harman/binary/ppdeploy/ppfp/:/flash:ro \
+  localhost/ppfp_bridge:<version> <key>
+```
+
+Compared with the basic command, these flags:
+
+- `--user 65534:65534` runs the bridge and every Flash player as the unprivileged user `nobody` instead of root.
+- `--read-only -v /tmp` makes the image's file system read-only, except `/tmp`.
+- `--cap-drop=ALL` removes all Linux capabilities; the bridge listens on an unprivileged port and needs none.
+- `--security-opt=no-new-privileges` prevents any process in the container from gaining privileges.
+- `:ro` mounts the folder with `libHCSFP.so` read-only.
+
 ---
 
 To read more about Docker, take a look at their official docs [here](https://docs.docker.com/).

sites/labs/src/content/docs/cheerpx-for-flash/20-native-bridge/tutorial.md

@@ -27,7 +27,7 @@ The flags that we have set are:
 
 For more information about `docker run`, read the official [Docker docs](https://docs.docker.com/engine/reference/run/).
 
-This tutorial runs the bridge without authentication, so anyone who can reach port 28083 can connect to it. For a deployment reachable from outside a trusted network, start the bridge with a key and pass a token from your server, as described in [restricting who can connect](/cheerpx-for-flash/native-bridge#how-do-i-restrict-who-can-connect-to-the-native-bridge).
+This tutorial runs the bridge without authentication, so anyone who can reach port 28083 can connect to it. For a deployment reachable from outside a trusted network, start the bridge with a key and pass a token from your server, as described in [restricting who can connect](/cheerpx-for-flash/native-bridge#how-do-i-restrict-who-can-connect-to-the-native-bridge). It also runs the bridge as root; for production, see [running the Native Bridge with the least privileges](/cheerpx-for-flash/native-bridge#how-do-i-run-the-native-bridge-with-the-least-privileges).
 
 Our Websockets server should now be running on port :28083:
 

sites/labs/src/content/docs/cheerpx-for-flash/80-changelog.md

@@ -2,6 +2,11 @@
 title: Changelog
 ---
 
+Version 43 - October 16th, 2026:
+
+    * Native Bridge hardening: the bridge can run as an unprivileged user, on a read-only file system and without Linux capabilities. See the Native Bridge page for an example setup.
+    * Updated dependencies.
+
 Version 42 - October 14th, 2026:
 
     * Optional Native Bridge authentication: when started with a key, the bridge requires a token on every connection.