backend/docker-entrypoint.sh

#!/bin/sh

chown nobody -R /execute/

exec capsh --caps="cap_net_admin,cap_setpcap,cap_setuid,cap_setgid,cap_sys_nice+eip" \
    --keep=1 --user=nobody --addamb=cap_net_admin,cap_sys_nice -- -c "python3 /execute/app.py DOCKER"
Dropped privileges from root to nobody, added capabilities with capsh 2022-08-02 13:13:58 +00:00			`#!/bin/sh`

Dockerfile to debian bookworm + stared rust project 2023-06-04 20:09:06 +02:00			`chown nobody -R /execute/`
Dropped privileges from root to nobody, added capabilities with capsh 2022-08-02 13:13:58 +00:00
niceness on firegex process 2025-03-26 22:25:09 +01:00			`exec capsh --caps="cap_net_admin,cap_setpcap,cap_setuid,cap_setgid,cap_sys_nice+eip" \`
			`--keep=1 --user=nobody --addamb=cap_net_admin,cap_sys_nice -- -c "python3 /execute/app.py DOCKER"`