detached 24f39fe

Merge branch 'main' into dependabot/go_modules/github.com/pelletier/go-toml/v2-2.3.0

commit
24f39feb0e53d413d9aae447e149a40ff4aeaf80
author
bnema · · 2026-03-29 13:16 UTC
committer
GitHub · · 2026-03-29 13:16 UTC
merge of
d275072 + 1983e1b · diff against the first parent
signature
GPG UnverifiedB5690EEEBB952194 The key is unknown
1 file · +5 -3
M internal/adapters/out/docker/runtime.go +5 -3
@@ -182,9 +182,11 @@ func (r *Runtime) CreateContainer(ctx context.Context, config *domain.ContainerC
182182 SecurityOpt: []string{"no-new-privileges:true"},
183183 CapDrop: strslice.StrSlice{"ALL"},
184184 // Re-add the minimal set of capabilities that standard images need.
185- // Without these, containers that chown files (e.g. postgres, mysql)
186- // or bind to ports <1024 (e.g. nginx) would fail to start.
187- CapAdd: strslice.StrSlice{"CHOWN", "SETUID", "SETGID", "NET_BIND_SERVICE"},
185+ // CHOWN/FOWNER/DAC_OVERRIDE: postgres, mysql etc. chown/chmod data dirs
186+ // owned by their service user during entrypoint init.
187+ // SETUID/SETGID: gosu/su-exec to drop privileges after init.
188+ // NET_BIND_SERVICE: nginx etc. binding to ports < 1024.
189+ CapAdd: strslice.StrSlice{"CHOWN", "DAC_OVERRIDE", "FOWNER", "SETUID", "SETGID", "NET_BIND_SERVICE"},
188190 }
189191
190192 // Create network configuration for container
@@ -182,9 +182,11 @@ func (r *Runtime) CreateContainer(ctx context.Context, config *domain.ContainerC
182 SecurityOpt: []string{"no-new-privileges:true"},182 SecurityOpt: []string{"no-new-privileges:true"},
183 CapDrop: strslice.StrSlice{"ALL"},183 CapDrop: strslice.StrSlice{"ALL"},
184 // Re-add the minimal set of capabilities that standard images need.184 // Re-add the minimal set of capabilities that standard images need.
185- // Without these, containers that chown files (e.g. postgres, mysql)185+ // CHOWN/FOWNER/DAC_OVERRIDE: postgres, mysql etc. chown/chmod data dirs
186- // or bind to ports <1024 (e.g. nginx) would fail to start.186+ // owned by their service user during entrypoint init.
187- CapAdd: strslice.StrSlice{"CHOWN", "SETUID", "SETGID", "NET_BIND_SERVICE"},187+ // SETUID/SETGID: gosu/su-exec to drop privileges after init.
188+ // NET_BIND_SERVICE: nginx etc. binding to ports < 1024.
189+ CapAdd: strslice.StrSlice{"CHOWN", "DAC_OVERRIDE", "FOWNER", "SETUID", "SETGID", "NET_BIND_SERVICE"},
188 }190 }
189 191
190 // Create network configuration for container192 // Create network configuration for container

Keyboard shortcuts

Single-key shortcuts are on. ctrl k and esc work whatever this says.

ctrl k :
go to a section, branch, tag, file or repository
?
this list
j k
move the row cursor down / up
enter
open the row under the cursor; on Files, a directory opens or closes in place
↑ ↓ ← → home end
in the file tree (focus on a row): previous / next row, close / open a directory or go to its parent / first entry, first / last row. They never open a file
l h
on Files: open a directory or a file / close a directory or go up to its parent, then to the parent page. Elsewhere: into the side panel (on a merge request, its files) / back to the content; there j k move between its controls
g g G
first / last row
/
filter the list; on Files, find a file anywhere in the repository (esc clears, enter opens the best match)
b
switch branch or tag
g s g f g c g b g m g i g r g a
tabs: summary, files, commits, branches & tags, merge requests, issues, releases, actions (when available)
g h
home
w
wide mode: use the whole width of the screen, or not (remembered)
y
copy a permalink pinned to the commit
d u x
diff: split / unified / collapse or expand all
e E
diff: the whole file in view / every file, with the lines the hunks hide
n
merge request: next note in the diff
esc
close a dialog, leave a field

Branches 7

Tags 106

↑↓ moveenter openesc close