From ef692dd72a2449c01c3d9e913027b396455fcf1a Mon Sep 17 00:00:00 2001 From: zenfyr.dev Date: Sun, 26 Oct 2025 11:27:49 +0000 Subject: [PATCH] spindle/engines/nixery: extend container caps kaniko (and other docker build tools) require permission to change file ownership to successfully build containers. i'm leaving this here for consideration, not sure about this security wise,, the better solution would be to use kvm, i think. in our case docker is running in sysbox without `privileged: true` so it _should_ be fine(??) Signed-off-by: zenfyr.dev --- spindle/engines/nixery/engine.go | 2 +- 1 file(s) changed, 1 insertion(s)(+), 1 deletion(s)(-) diff --git a/spindle/engines/nixery/engine.go b/spindle/engines/nixery/engine.go --- a/spindle/engines/nixery/engine.go +++ b/spindle/engines/nixery/engine.go @@ -222,7 +222,7 @@ }, ReadonlyRootfs: false, CapDrop: []string{"ALL"}, - CapAdd: []string{"CAP_DAC_OVERRIDE"}, + CapAdd: []string{"CAP_DAC_OVERRIDE", "CAP_CHOWN", "CAP_FOWNER", "CAP_SETUID", "CAP_SETGID"}, SecurityOpt: []string{"no-new-privileges"}, ExtraHosts: []string{"host.docker.internal:host-gateway"}, }, nil, nil, "") -- tangled.sh