From 10de344c5c8a787ae28109cc4a00cb3526247c55 Mon Sep 17 00:00:00 2001 From: Dan Guido Date: Fri, 28 Nov 2025 15:21:53 -0500 Subject: [PATCH] Fix Docker --cap-drop=all and add multi-arch support (#14900) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Fix Docker --cap-drop=all and add multi-arch support Fixes #14899 ## Bug Fix: CAP_DROP_ALL Permission Denied The `chown -R algo:algo /algo` line added in commit 2ab57c3 broke `--cap-drop=all` functionality. When running as root with all capabilities dropped, root loses CAP_DAC_OVERRIDE and cannot write to files owned by other users. The fix removes the unnecessary chown since: - Container runs as USER root - algo-docker.sh writes to /algo/config.cfg at runtime - /algo must be root-owned for --cap-drop=all to work ## Multi-arch Support The Docker image was only built for linux/amd64. Added: - QEMU setup for ARM emulation - Docker Buildx for multi-platform builds - platforms: linux/amd64,linux/arm64 This enables native support for Apple Silicon Macs. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude * Update Docker actions to latest versions - setup-qemu-action: v3.6.0 → v3.7.0 - setup-buildx-action: v3.10.0 → v3.11.1 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --------- Co-authored-by: Claude --- .github/workflows/docker-image.yaml | 7 +++++++ Dockerfile | 4 ++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker-image.yaml b/.github/workflows/docker-image.yaml index e8e264c0..646d380e 100644 --- a/.github/workflows/docker-image.yaml +++ b/.github/workflows/docker-image.yaml @@ -22,6 +22,12 @@ jobs: with: persist-credentials: false + - name: Set up QEMU + uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + - name: Log in to the Container registry uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 with: @@ -43,5 +49,6 @@ jobs: with: context: . push: true + platforms: linux/amd64,linux/arm64 tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} diff --git a/Dockerfile b/Dockerfile index 00f87b66..fe011574 100644 --- a/Dockerfile +++ b/Dockerfile @@ -31,9 +31,9 @@ RUN uv sync --locked --no-dev COPY . . # Set executable permissions and prepare runtime +# Note: /algo must remain root-owned for --cap-drop=all compatibility +# (root without CAP_DAC_OVERRIDE cannot write to files owned by others) RUN chmod 0755 /algo/algo-docker.sh && \ - chown -R algo:algo /algo && \ - # Create volume mount point with correct ownership mkdir -p /data && \ chown algo:algo /data