From 4db8fd658375caa40a303b5ef5f2fe7002f16bf1 Mon Sep 17 00:00:00 2001 From: Mikhail Lobanov Date: Wed, 14 Oct 2026 21:50:42 +0300 Subject: [PATCH] Drop all Linux capabilities for app container --- .gitea/workflows/ci.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 131c81a..d360c9c 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -72,6 +72,7 @@ jobs: --name devops-platform \ --restart unless-stopped \ --read-only \ + --cap-drop=ALL \ -p 127.0.0.1:8000:8000 \ "$IMAGE"; then echo "New container started" @@ -81,6 +82,7 @@ jobs: --name devops-platform \ --restart unless-stopped \ --read-only \ + --cap-drop=ALL \ -p 127.0.0.1:8000:8000 \ "$OLD_IMAGE" exit 1 @@ -107,6 +109,7 @@ jobs: --name devops-platform \ --restart unless-stopped \ --read-only \ + --cap-drop=ALL \ -p 127.0.0.1:8000:8000 \ "$OLD_IMAGE" exit 1