search

fabiolb / fabio

Consul Load-Balancing made simple
https://fabiolb.net
MIT License
7.25k stars 620 forks source link

Dockerfile: add CAP_NET_BIND_SERVICE+eip to fabio to allow running as root #938

Open Kamilcuk opened 10 months ago

Kamilcuk commented 10 months ago

Without the change, the following fails:

$ docker build -t myfabio . && docker run -e CONSUL_HTTP_ADDR=$CONSUL_HTTP_ADDR -e CONSUL_HTTP_AUTH=$CONSUL_HTTP_AUTH --rm -u nobody:nobody --network=host myfabio -registry.consul.addr=http://192.168.40.1:8500 -proxy.addr=0.0.0.0:80
[+] Building 37.2s (23/23) FINISHED                                                                                        docker:default
.....
2023/09/07 09:52:45 [FATAL] listen: Fail to listen. listen tcp 0.0.0.0:80: bind: permission denied
.....

After the change, it works. This is the only change needed to run fabio as non-root. System administrator can choose the user with docker options.

Related: https://github.com/fabiolb/fabio/issues/369 https://github.com/marco-m/fabio/commit/c0391d25f2aa29aa4697765c4d4c847d33d6ad6e https://github.com/fabiolb/fabio/pull/851