Make ingress drill Docker socket portable

2026-08-03 17:55:48 +02:00
parent 25424187a8
commit 282c90c54b
3 changed files with 6 additions and 0 deletions
@@ -162,6 +162,9 @@ Ingress acceptance streams generated configuration into Docker-managed
 volumes before starting the read-only containers. It therefore also works when
 an Actions job reaches a host or remote Docker daemon through a mounted socket;
 the drill never assumes that a job-container path is visible to that daemon.
+The bounded setup helper writes only generated public configuration as root so
+it can initialize a new volume; the actual HAProxy process retains the image's
+non-root identity and runs read-only with all capabilities dropped.

 The manifest contract is
 [`runtime-distribution-manifest.schema.json`](runtime-distribution-manifest.schema.json),