Retain Caddy file capability at ingress boundary

2026-08-03 20:02:29 +02:00
parent d107d94fec
commit 1f039dd39c
5 changed files with 12 additions and 0 deletions
@@ -627,6 +627,7 @@ def render_compose(spec: InstallationSpec) -> dict[str, object]:
            "tmpfs": ["/tmp:rw,noexec,nosuid,size=64m"],
            "security_opt": ["no-new-privileges:true"],
            "cap_drop": ["ALL"],
+            "cap_add": ["NET_BIND_SERVICE"],
            "volumes": [
                f"./{CADDY_CONFIG_FILENAME}:/etc/caddy/Caddyfile:ro",
                "caddy-data:/data",