Dockerfile: drop cap_sys_nice file caps — they break exec on unprivileged-LXC hosts (lab net-sim crash-looped) - #20
Merged
Conversation
…ricted hosts The setcap cap_sys_nice+ep on sim-web/sim-router (added with -rt-priority in #17) makes the binaries refuse to exec — "operation not permitted" / EPERM — on any host whose capability bounding set lacks CAP_SYS_NICE, e.g. an unprivileged LXC. That broke the image for EVERY run on such hosts, including the overwhelming majority that never pass -rt-priority: the production lab net-sim crash-looped (Restarting 255) the moment it pulled the new :main. File capabilities were the wrong mechanism. -rt-priority needs CAP_SYS_NICE granted at RUNTIME (--cap-add SYS_NICE, running as root or with the cap in the userns), which the README already documents; and it already degrades gracefully (one-line warning, normal priority) where the platform won't grant it. So the binaries must stay capability-free: remove both setcap lines and the libcap2-bin install they needed. Reproduced and verified locally: `docker run --cap-drop SYS_NICE --entrypoint sim-web <old:main> --help` → "operation not permitted"; same on the corrected image → prints usage. New internal/dockerfile guard test fails if a setcap line is ever reintroduced on the binaries. make test green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#17 added
setcap cap_sys_nice+eptosim-web/sim-routerso-rt-prioritycould renice as the non-rootsimuser. That was the wrong mechanism: a file capability with the effective bit set makes the kernel refuse to exec the binary (operation not permitted/ EPERM) on any host whose capability bounding set lacksCAP_SYS_NICE— e.g. an unprivileged LXC. So the new:mainbroke the image for every run on such hosts, including the vast majority that never pass-rt-priority.Impact: the production lab net-sim (an unprivileged systemd LXC) crash-looped
Restarting (255)withexec /usr/local/bin/sim-web: operation not permittedthe instant it pulled the post-#17:main.-rt-priorityneedsCAP_SYS_NICEgranted at runtime (--cap-add SYS_NICE, running as root or with the cap in the user namespace) — which the README already documents — and it already degrades gracefully (logs one line, runs at normal priority) where the platform won't grant it. So the binaries must stay capability-free.This change: remove both
setcaplines + thelibcap2-bininstall they required; README now states the cap is runtime-granted by design and explains the exec-EPERM trap; newinternal/dockerfileguard test fails if asetcapline is ever reintroduced on the binaries.Verified:
docker run --rm --cap-drop SYS_NICE --entrypoint /usr/local/bin/sim-web <old-:main> --help→operation not permitted; the corrected image under the same--cap-drop SYS_NICE→ prints usage and runs.make testgreen.🤖 Generated with Claude Code