Install libcap and run setcap cap_net_bind_service=+eip on caddy bi…

…nary Mitigates caddyserver#104
abjugard · Jan 17, 2023 · e357905 · e357905
1 parent ffa8b84
commit e357905
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 3 deletions.
diff --git a/2.6/alpine/Dockerfile b/2.6/alpine/Dockerfile
@@ -1,6 +1,6 @@
 FROM alpine:3.16
 
-RUN apk add --no-cache ca-certificates mailcap
+RUN apk add --no-cache ca-certificates mailcap libcap
 
 RUN set -eux; \
 	mkdir -p \
@@ -30,6 +30,7 @@ RUN set -eux; \
 	echo "$checksum  /tmp/caddy.tar.gz" | sha512sum -c; \
 	tar x -z -f /tmp/caddy.tar.gz -C /usr/bin caddy; \
 	rm -f /tmp/caddy.tar.gz; \
+    setcap cap_net_bind_service=+eip /usr/bin/caddy; \
 	chmod +x /usr/bin/caddy; \
 	caddy version
 

diff --git a/Dockerfile.tmpl b/Dockerfile.tmpl
@@ -1,6 +1,6 @@
 {{ .base | strings.TrimSpace }}
 
-RUN apk add --no-cache ca-certificates mailcap
+RUN apk add --no-cache ca-certificates mailcap libcap
 
 RUN set -eux; \
 	mkdir -p \
@@ -30,6 +30,7 @@ RUN set -eux; \
 	echo "$checksum  /tmp/caddy.tar.gz" | sha512sum -c; \
 	tar x -z -f /tmp/caddy.tar.gz -C /usr/bin caddy; \
 	rm -f /tmp/caddy.tar.gz; \
+	setcap cap_net_bind_service=+eip /usr/bin/caddy; \
 	chmod +x /usr/bin/caddy; \
 	caddy version
 
@@ -53,4 +54,4 @@ EXPOSE 2019
 
 WORKDIR /srv
 
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]