Retain Caddy file capability at ingress boundary

2026-08-03 20:02:29 +02:00
parent d107d94fec
commit 1f039dd39c
5 changed files with 12 additions and 0 deletions
@@ -551,6 +551,9 @@ class DeploymentInstallerTests(unittest.TestCase):
        )
        self.assertIn("caddy-data:/data", ingress["volumes"])
        self.assertIn("caddy-config:/config", ingress["volumes"])
+        self.assertEqual(["ALL"], ingress["cap_drop"])
+        self.assertEqual(["NET_BIND_SERVICE"], ingress["cap_add"])
+        self.assertEqual(["no-new-privileges:true"], ingress["security_opt"])
        self.assertIn("reverse_proxy load-balancer:8080", render_caddy_config(spec))
        self.assertNotIn("operator@example.test", json.dumps(compose))