Drop all Linux capabilities for app container

2026-10-14 21:50:42 +03:00
parent e79f41d2b9
commit 4db8fd6583
1 changed files with 3 additions and 0 deletions
@@ -72,6 +72,7 @@ jobs:
            --name devops-platform \
            --restart unless-stopped \
            --read-only \
+            --cap-drop=ALL \
            -p 127.0.0.1:8000:8000 \
            "$IMAGE"; then
            echo "New container started"
@@ -81,6 +82,7 @@ jobs:
              --name devops-platform \
              --restart unless-stopped \
              --read-only \
+              --cap-drop=ALL \
              -p 127.0.0.1:8000:8000 \
              "$OLD_IMAGE"
            exit 1
@@ -107,6 +109,7 @@ jobs:
              --name devops-platform \
              --restart unless-stopped \
              --read-only \
+              --cap-drop=ALL \
              -p 127.0.0.1:8000:8000 \
              "$OLD_IMAGE"
            exit 1