Install libcap and run setcap cap_net_bind_service=+ep on caddy binary

Mitigates caddyserver#104
abjugard · Jan 21, 2023 · 159cb29 · 159cb29
1 parent 579fe03
commit 159cb29
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 4 deletions.
diff --git a/2.6/alpine/Dockerfile b/2.6/alpine/Dockerfile
@@ -1,6 +1,9 @@
 FROM alpine:3.16
 
-RUN apk add --no-cache ca-certificates mailcap
+RUN apk add --no-cache \
+	ca-certificates \
+	libcap \
+	mailcap
 
 RUN set -eux; \
 	mkdir -p \
@@ -30,6 +33,7 @@ RUN set -eux; \
 	echo "$checksum  /tmp/caddy.tar.gz" | sha512sum -c; \
 	tar x -z -f /tmp/caddy.tar.gz -C /usr/bin caddy; \
 	rm -f /tmp/caddy.tar.gz; \
+	setcap cap_net_bind_service=+ep /usr/bin/caddy; \
 	chmod +x /usr/bin/caddy; \
 	caddy version
 
@@ -53,4 +57,4 @@ EXPOSE 2019
 
 WORKDIR /srv
 
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
diff --git a/Dockerfile.tmpl b/Dockerfile.tmpl
@@ -1,6 +1,9 @@
 {{ .base | strings.TrimSpace }}
 
-RUN apk add --no-cache ca-certificates mailcap
+RUN apk add --no-cache \
+	ca-certificates \
+	libcap \
+	mailcap
 
 RUN set -eux; \
 	mkdir -p \
@@ -30,6 +33,7 @@ RUN set -eux; \
 	echo "$checksum  /tmp/caddy.tar.gz" | sha512sum -c; \
 	tar x -z -f /tmp/caddy.tar.gz -C /usr/bin caddy; \
 	rm -f /tmp/caddy.tar.gz; \
+	setcap cap_net_bind_service=+ep /usr/bin/caddy; \
 	chmod +x /usr/bin/caddy; \
 	caddy version
 
@@ -53,4 +57,4 @@ EXPOSE 2019
 
 WORKDIR /srv
 
-CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]
+CMD ["caddy", "run", "--config", "/etc/caddy/Caddyfile", "--adapter", "caddyfile"]