From 61eab04d0e77ebe9c77122ddd04a3f6d10b91233 Mon Sep 17 00:00:00 2001 From: Fs00 Date: Sat, 25 Apr 2026 18:46:48 +0200 Subject: [PATCH] Drop any extra caps for collabora when seccomp profile is enabled Signed-off-by: Fs00 --- php/src/Docker/DockerActionManager.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/php/src/Docker/DockerActionManager.php b/php/src/Docker/DockerActionManager.php index 40747725..f528c389 100644 --- a/php/src/Docker/DockerActionManager.php +++ b/php/src/Docker/DockerActionManager.php @@ -440,9 +440,11 @@ readonly class DockerActionManager { // Special things for the collabora container which should not be exposed in the containers.json } elseif ($container->identifier === 'nextcloud-aio-collabora') { if (!$this->configurationManager->collaboraSeccompDisabled) { - // Load reference seccomp profile for collabora + // Load reference seccomp profile for collabora... $seccompProfile = (string)file_get_contents(DataConst::GetCollaboraSeccompProfilePath()); $requestBody['HostConfig']['SecurityOpt'] = ["label:disable", "seccomp=$seccompProfile"]; + // ...which allows the collabora container to run without any capabilities + $requestBody['HostConfig']['CapAdd'] = []; } // Additional Collabora options