Merge pull request #1096 from jcmoraisjr/jm-setcap

Add net bind capability to haproxy bin
jcmoraisjr · May 4, 2024 · c52386c · c52386c
2 parents 7f0bcf7 + 2aefe7a
commit c52386c
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 4 deletions.
diff --git a/builder/Dockerfile b/builder/Dockerfile
@@ -32,14 +32,15 @@ FROM haproxy:2.6.16-alpine
 
 USER root
 
-RUN apk upgrade --no-cache && apk --no-cache add socat openssl lua5.3 lua-json4 dumb-init
+RUN apk upgrade --no-cache && apk --no-cache add libcap-utils socat openssl lua5.3 lua-json4 dumb-init
 
 COPY rootfs/ /
 COPY --from=builder /src/haproxy-ingress /haproxy-ingress-controller
 
 RUN mkdir -p /var/empty /etc/haproxy /var/lib/haproxy /var/run/haproxy\
  && chown -R haproxy:haproxy /etc/haproxy /var/lib/haproxy /var/run/haproxy\
- && chmod 0 /var/empty
+ && chmod 0 /var/empty\
+ && setcap 'cap_net_bind_service=+ep' /usr/local/sbin/haproxy
 
 STOPSIGNAL SIGTERM
 USER haproxy

diff --git a/rootfs/Dockerfile b/rootfs/Dockerfile
@@ -16,13 +16,14 @@ FROM haproxy:2.6.16-alpine
 
 USER root
 
-RUN apk upgrade --no-cache && apk --no-cache add socat openssl lua5.3 lua-json4 dumb-init
+RUN apk upgrade --no-cache && apk --no-cache add libcap-utils socat openssl lua5.3 lua-json4 dumb-init
 
 COPY . /
 
 RUN mkdir -p /var/empty /etc/haproxy /var/lib/haproxy /var/run/haproxy\
  && chown -R haproxy:haproxy /etc/haproxy /var/lib/haproxy /var/run/haproxy\
- && chmod 0 /var/empty
+ && chmod 0 /var/empty\
+ && setcap 'cap_net_bind_service=+ep' /usr/local/sbin/haproxy
 
 STOPSIGNAL SIGTERM
 USER haproxy