Retain Caddy file capability at ingress boundary

2026-08-03 20:02:29 +02:00
parent d107d94fec
commit 1f039dd39c
5 changed files with 12 additions and 0 deletions
@@ -388,6 +388,8 @@ def main() -> int:
                "no-new-privileges",
                "--cap-drop",
                "ALL",
+                "--cap-add",
+                "NET_BIND_SERVICE",
                "--publish",
                f"127.0.0.1:{requested_http_port}:8080/tcp",
                "--publish",
@@ -627,6 +627,7 @@ def render_compose(spec: InstallationSpec) -> dict[str, object]:
            "tmpfs": ["/tmp:rw,noexec,nosuid,size=64m"],
            "security_opt": ["no-new-privileges:true"],
            "cap_drop": ["ALL"],
+            "cap_add": ["NET_BIND_SERVICE"],
            "volumes": [
                f"./{CADDY_CONFIG_FILENAME}:/etc/caddy/Caddyfile:ro",
                "caddy-data:/data",