Merge pull request #2 from dash14/harden/replace-privileged-with-cap-add

Replace privileged: true with minimum required capabilities

Author: dash14

.gitignore

@@ -0,0 +1 @@
+.DS_Store

compose.yml

@@ -3,7 +3,28 @@ services:
     build:
       context: docker
       dockerfile: Dockerfile
-    privileged: true
+    # Instead of privileged: true, grant only the minimum privileges required
+    # to run BuildKit and iptables. This avoids granting full device access
+    # and unrestricted /sys write permissions that privileged mode includes.
+    #
+    # BuildKit OCI worker requires SYS_ADMIN for mount, namespaces, and cgroups.
+    # iptables and CNI networking require NET_ADMIN.
+    # runc needs SYS_PTRACE to access /proc/PID/ns/mnt for mount namespace setup.
+    cap_add:
+      - SYS_ADMIN
+      - NET_ADMIN
+      - SYS_PTRACE
+    # BuildKit/runc needs syscalls (mount, unshare, pivot_root) blocked by
+    # default seccomp and AppArmor profiles.
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
+    # Share the host's cgroup namespace so BuildKit can manage cgroups for
+    # build containers. The volume mount makes /sys/fs/cgroup writable
+    # (read-only by default in non-privileged containers).
+    cgroup: host
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
     ports:
       - "${PORT:-1234}:1234"
     environment:

setup/compose.yml

@@ -1,7 +1,28 @@
 services:
   builder:
     image: ${BUILDCAGE_IMAGE}:${BUILDCAGE_VERSION:-1}
-    privileged: true
+    # Instead of privileged: true, grant only the minimum privileges required
+    # to run BuildKit and iptables. This avoids granting full device access
+    # and unrestricted /sys write permissions that privileged mode includes.
+    #
+    # BuildKit OCI worker requires SYS_ADMIN for mount, namespaces, and cgroups.
+    # iptables and CNI networking require NET_ADMIN.
+    # runc needs SYS_PTRACE to access /proc/PID/ns/mnt for mount namespace setup.
+    cap_add:
+      - SYS_ADMIN
+      - NET_ADMIN
+      - SYS_PTRACE
+    # BuildKit/runc needs syscalls (mount, unshare, pivot_root) blocked by
+    # default seccomp and AppArmor profiles.
+    security_opt:
+      - seccomp=unconfined
+      - apparmor=unconfined
+    # Share the host's cgroup namespace so BuildKit can manage cgroups for
+    # build containers. The volume mount makes /sys/fs/cgroup writable
+    # (read-only by default in non-privileged containers).
+    cgroup: host
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
     ports:
       - "${PORT:-1234}:1234"
     environment: