Hotfix 0.5.1 into main: the web image runs with capabilities dropped #269

Merged

littlefox merged 1 commit from hotfix-0.5.1 into main 2026-10-22 06:17:25 +00:00

Conversation 0 Commits 1 Files changed 8 +29 -9

littlefox commented 2026-10-22 05:33:10 +00:00

Owner

Copy link

Closes #268

Tagged as v0.5.1 from this branch (cut from v0.5.0, only this fix). This brings the fix and the 0.5.1 changelog into main.

• packaging/docker/Dockerfile: caddy copied without the file capability the caddy image gives it.
• tools/web-image-ci.sh: the smoke run uses --user 999:999 --read-only --tmpfs /tmp --cap-drop ALL --security-opt no-new-privileges, like Lysator's pod.

Verified: the 0.5.0 image fails locked down (exec /usr/local/bin/caddy: operation not permitted, same as the pod log); the fixed image, run locked down with the deployment's environment, serves the page (200) and upgrades /relay (101).

🤖 Generated with Claude Code

https://claude.ai/code/session_01XJW2ocwLunyaLiUwCBHEP8

Closes #268 Tagged as v0.5.1 from this branch (cut from v0.5.0, only this fix). This brings the fix and the 0.5.1 changelog into main. - `packaging/docker/Dockerfile`: caddy copied without the file capability the caddy image gives it. - `tools/web-image-ci.sh`: the smoke run uses `--user 999:999 --read-only --tmpfs /tmp --cap-drop ALL --security-opt no-new-privileges`, like Lysator's pod. Verified: the 0.5.0 image fails locked down (`exec /usr/local/bin/caddy: operation not permitted`, same as the pod log); the fixed image, run locked down with the deployment's environment, serves the page (200) and upgrades /relay (101). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01XJW2ocwLunyaLiUwCBHEP8

littlefox added 1 commit 2026-10-22 05:33:10 +00:00

Hotfix 0.5.1: the web image runs with capabilities dropped ... ceb496c2ad

0.5.0's image was the first built in CI, and its builder kept the file
capability (cap_net_bind_service) that the caddy image gives its binary.
Where capabilities are dropped and no new privileges may be gained, as on
Lysator's Kubernetes, such a binary can't be executed at all: caddy
failed with 'Operation not permitted', nothing listened on 8080, and
neokom.lysator.liu.se answered 503 after the autoroll. The image now
copies caddy without the capability (it listens on 8080 and needs none),
and the CI check runs the image locked down the same way.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XJW2ocwLunyaLiUwCBHEP8

littlefox referenced this pull request 2026-10-22 06:04:41 +00:00

neokom.lysator.liu.se down after the 0.5.0 autoroll: caddy "Operation not permitted" #268

littlefox merged commit 818b9978a0 into main 2026-10-22 06:17:25 +00:00

littlefox referenced this pull request from a commit 2026-10-22 06:17:26 +00:00

Merge pull request 'Hotfix 0.5.1 into main: the web image runs with capabilities dropped' (#269) from hotfix-0.5.1 into main

littlefox referenced this pull request 2026-10-22 14:11:05 +00:00

Release 0.6.0 #281

littlefox referenced this pull request from a commit 2026-10-22 14:11:06 +00:00

Release 0.6.0

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area/ci

Forgejo Actions, runner, tests

  

area/desktop

Desktop build

  

area/packaging

Arch, Debian, Fedora, NixOS packages

  

area/protocol

kom-proto, wire format, charset

  

area/reading

Unread tracking, reading order, review

  

area/ui

Dioxus app, layout, interaction

  

area/web

Web build and relay

  

area/writing

Composing and sending texts

  

kind/bug

Something is broken

  

kind/feature

New functionality

  

kind/infra

Tooling, tests, CI, dev environment

  

kind/request

requests for features or changes from users

  

needs/user

Waiting for a decision or action from littlefox

  

parked

Kept for reference; no work planned until the user says so

  

perf

Run the perf workflow and its budgets on this pull request (#287)

  

security

Security-relevant

  

upstream

A proposal for Protocol A or lyskomd, for the LysKOM development group

No labels

area/ci

area/desktop

area/packaging

area/protocol

area/reading

area/ui

area/web

area/writing

kind/bug

kind/feature

kind/infra

kind/request

needs/user

parked

perf

security

upstream

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

littlefox/neokom!269

No description provided.