deploy: pin production proxy and resource limits

deploy/production/compose.yaml

@@ -46,6 +46,10 @@ services:
     expose:
       - "6899"
       - "6901"
+    ulimits:
+      nofile:
+        soft: 65536
+        hard: 65536
     healthcheck:
       test: ["CMD", "wget", "-q", "-O", "/dev/null", "http://127.0.0.1:6901/readyz"]
       interval: 15s
@@ -60,7 +64,7 @@ services:
         condition: service_completed_successfully
 
   nginx:
-    image: nginx:1.27.5-alpine
+    image: nginx@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10
     restart: unless-stopped
     read_only: true
     depends_on:
@@ -68,6 +72,10 @@ services:
         condition: service_healthy
     ports:
       - "${RVBOX_HTTPS_BIND:-0.0.0.0}:${RVBOX_HTTPS_PORT:-443}:443"
+    ulimits:
+      nofile:
+        soft: 65536
+        hard: 65536
     tmpfs:
       - /var/cache/nginx:uid=101,gid=101,mode=0755,size=16m
       - /var/run:uid=101,gid=101,mode=0755,size=4m

test/windowsnative/native_fixture_test.go

@@ -73,6 +73,8 @@ func TestProductionComposeAssets_HP_OPS_01(t *testing.T) {
 	for _, required := range []string{
 		"RVBOX_SERVER_CONFIG:-./server.toml",
 		"RVBOX_HTTPS_BIND:-0.0.0.0",
+		"nginx@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10",
+		"nofile:", "soft: 65536", "hard: 65536",
 		"condition: service_completed_successfully",
 		"condition: service_healthy",
 		"NET_BIND_SERVICE", "DAC_OVERRIDE", "CHOWN", "SETUID", "SETGID",