Retain Caddy file capability at ingress boundary

tests/test_deployment_installer.py

@@ -551,6 +551,9 @@ class DeploymentInstallerTests(unittest.TestCase):
         )
         self.assertIn("caddy-data:/data", ingress["volumes"])
         self.assertIn("caddy-config:/config", ingress["volumes"])
+        self.assertEqual(["ALL"], ingress["cap_drop"])
+        self.assertEqual(["NET_BIND_SERVICE"], ingress["cap_add"])
+        self.assertEqual(["no-new-privileges:true"], ingress["security_opt"])
         self.assertIn("reverse_proxy load-balancer:8080", render_caddy_config(spec))
         self.assertNotIn("operator@example.test", json.dumps(compose))
 

tests/test_managed_ingress_drill.py

@@ -64,6 +64,7 @@ class ManagedIngressDrillTests(unittest.TestCase):
         self.assertNotIn('"127.0.0.1::8080"', source)
         self.assertIn("requested_http_port", source)
         self.assertIn("requested_https_port", source)
+        self.assertIn('"--cap-add",\n                "NET_BIND_SERVICE"', source)
 
     def test_published_port_reads_the_docker_mapping(self) -> None:
         completed = subprocess.CompletedProcess(