daenamnu/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/all-in-one.git synced 2026-09-19 01:37:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Drop NET_RAW cap by default when no caps are explicitly dropped

Browse Source 
Signed-off-by: Fs00 <francescosaltori@gmail.com>
This commit is contained in:
Fs00
2026-04-28 18:05:30 +02:00
parent 61eab04d0e
commit 5dbc642530
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
php/src/Docker/DockerActionManager.php
+3
View File
@@ -381,6 +381,9 @@ readonly class DockerActionManager {
$capDrops = $container->capDrop;
if (count($capDrops) > 0) {
$requestBody['HostConfig']['CapDrop'] = $capDrops;
} else if (!in_array('NET_RAW', $capAdds, true)) {
// Prevent ARP spoofing by default
$requestBody['HostConfig']['CapDrop'] = ['NET_RAW'];
}
// Disable SELinux for AIO containers so that it does not break them