GovOPlaN/govoplan
2
0
Fork 0
Code Issues 18 Pull Requests Actions Packages Projects Releases 3 Wiki Activity

Retain Caddy file capability at ingress boundary

Browse Source
This commit is contained in:
zemion
2026-08-03 20:02:29 +02:00
parent d107d94fec
commit 1f039dd39c
5 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/INSTALLATION_AND_DEPLOYMENT_ARCHITECTURE.md
+5
View File
@@ -185,6 +185,11 @@ The dispatch-only `Runtime Ingress Drill` workflow exposes the same bounded
check independently so ingress changes can be diagnosed before an immutable
runtime publication; it accepts only digest-pinned Caddy, HAProxy, and API
images and has no push trigger.
The official Caddy binary carries the `NET_BIND_SERVICE` file capability. The
managed-ingress container therefore drops every capability and adds back only
`NET_BIND_SERVICE`; otherwise Linux rejects the binary at `execve` before its
high-port configuration can start. `no-new-privileges`, a read-only root
filesystem, and non-privileged container ports remain enforced.
The bounded setup helper writes only generated public configuration as root so
it can initialize a new volume; the actual HAProxy process retains the image's
non-root identity and runs read-only with all capabilities dropped.