deploy: pin production proxy and resource limits

deploy/production/compose.yaml

@@ -46,6 +46,10 @@ services:
     expose:
       - "6899"
       - "6901"
+    ulimits:
+      nofile:
+        soft: 65536
+        hard: 65536
     healthcheck:
       test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:6901/readyz"]
       interval: 15s
@@ -60,7 +64,7 @@ services:
         condition: service_completed_successfully
 
   nginx:
-    image: nginx:1.27.5-alpine
+    image: nginx@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10
     restart: unless-stopped
     read_only: true
     depends_on:
@@ -68,6 +72,10 @@ services:
         condition: service_healthy
     ports:
       - "${RVBOX_HTTPS_BIND:-0.0.0.0}:${RVBOX_HTTPS_PORT:-443}:443"
+    ulimits:
+      nofile:
+        soft: 65536
+        hard: 65536
     tmpfs:
       - /var/cache/nginx:uid=101,gid=101,mode=0755,size=16m
       - /var/run:uid=101,gid=101,mode=0755,size=4m