From 1ea047bea168b5bde8a07e941f3b0d5542674503 Mon Sep 17 00:00:00 2001 From: Dorian Date: Sun, 29 Mar 2026 15:24:28 +0100 Subject: [PATCH] fix: default container caps for rootless podman reliability All containers now get CHOWN+FOWNER+SETUID+SETGID+DAC_OVERRIDE+NET_BIND_SERVICE as the default cap set. Rootless podman needs these for: - CHOWN/FOWNER/DAC_OVERRIDE: file ownership in mapped UID namespace - SETUID/SETGID: internal user switching (entrypoint scripts) - NET_BIND_SERVICE: port binding in network namespaces Tested on .198: Grafana, Vaultwarden, Bitcoin Knots all start successfully. Previously failed with "Permission denied" or "loopback adapter" errors. Co-Authored-By: Claude Opus 4.6 (1M context) --- core/archipelago/src/api/rpc/package/config.rs | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/core/archipelago/src/api/rpc/package/config.rs b/core/archipelago/src/api/rpc/package/config.rs index 41b56d81..eb6511d2 100644 --- a/core/archipelago/src/api/rpc/package/config.rs +++ b/core/archipelago/src/api/rpc/package/config.rs @@ -103,8 +103,14 @@ pub(super) fn get_app_capabilities(app_id: &str) -> Vec { "--cap-add=DAC_OVERRIDE".to_string(), "--cap-add=NET_BIND_SERVICE".to_string(), ], - // Default: NET_BIND_SERVICE for port binding in rootless podman networks + // Default: standard capabilities for rootless podman containers + // Most apps need file ownership + port binding to function correctly _ => vec![ + "--cap-add=CHOWN".to_string(), + "--cap-add=FOWNER".to_string(), + "--cap-add=SETUID".to_string(), + "--cap-add=SETGID".to_string(), + "--cap-add=DAC_OVERRIDE".to_string(), "--cap-add=NET_BIND_SERVICE".to_string(), ], }