F27: container fleet missing CapDrop / ReadOnly / no-new-privileges (round 2) #5

New issue

Open

opened 2026-05-06 10:56:41 +01:00 by s8n · 0 comments

s8n commented

2026-05-06 10:56:41 +01:00

Owner

Severity: Medium
Status: Partial — 9/28 stateless containers capped (tuwunel×2, livekit, lk-jwt, commet-web, cinny-txt, signup-txt, signup-page, dl-veilor). 19 remaining.

Remaining:
pihole, rocketchat, mongodb, minecraft-mc, headscale, anythingllm, filebrowser-mc, authentik (server+worker), forgejo, forgejo-runner, misskey, misskey-redis, misskey-db, x-source, n8n, n8n-db, step-ca, livekit-db.

Fix: Per-service CAP_ADD only what's needed (e.g. pihole = NET_BIND_SERVICE; mc = nothing; postgres = SETUID, SETGID; etc.). read_only: true where compatible. security_opt: [no-new-privileges:true] on all.

Verification: docker inspect <c> --format '{{.HostConfig.CapAdd}} {{.HostConfig.CapDrop}} {{.HostConfig.ReadonlyRootfs}}' matches per-service spec.

Source: security/nullstone-server/2026-05-02.md §F27.

**Severity:** Medium **Status:** Partial — 9/28 stateless containers capped (tuwunel×2, livekit, lk-jwt, commet-web, cinny-txt, signup-txt, signup-page, dl-veilor). 19 remaining. **Remaining:** pihole, rocketchat, mongodb, minecraft-mc, headscale, anythingllm, filebrowser-mc, authentik (server+worker), forgejo, forgejo-runner, misskey, misskey-redis, misskey-db, x-source, n8n, n8n-db, step-ca, livekit-db. **Fix:** Per-service CAP_ADD only what's needed (e.g. pihole = NET_BIND_SERVICE; mc = nothing; postgres = SETUID, SETGID; etc.). `read_only: true` where compatible. `security_opt: [no-new-privileges:true]` on all. **Verification:** `docker inspect <c> --format '{{.HostConfig.CapAdd}} {{.HostConfig.CapDrop}} {{.HostConfig.ReadonlyRootfs}}'` matches per-service spec. Source: `security/nullstone-server/2026-05-02.md` §F27.