image: rngd
config:
  capabilities:
    - CAP_SYS_ADMIN
  oomScoreAdj: -800
  readonly: true
  net: new
  ipc: new