Dockerfile: add CAP_NET_BIND_SERVICE+eip to fabio to allow running as root

[Kamilcuk]

Without the change, the following fails:

$ docker build -t myfabio . && docker run -e CONSUL_HTTP_ADDR=$CONSUL_HTTP_ADDR -e CONSUL_HTTP_AUTH=$CONSUL_HTTP_AUTH --rm -u nobody:nobody --network=host myfabio -registry.consul.addr=http://192.168.40.1:8500 -proxy.addr=0.0.0.0:80
[+] Building 37.2s (23/23) FINISHED                                                                                        docker:default
.....
2023/09/07 09:52:45 [FATAL] listen: Fail to listen. listen tcp 0.0.0.0:80: bind: permission denied
.....

After the change, it works. This is the only change needed to run fabio as non-root. System administrator can choose the user with docker options.

Related: #369 marco-m@c0391d2 #851

[tristanmorgan]

Looks good to me.

[tristanmorgan]

@Kamilcuk can you do a quick rebase, just realised vendoring changes in #951 made this conflict.

[aaronhurt]

If your using setcap shouldn’t you be running as non-root? The root user already has permissions.

[tristanmorgan]

if you add a USER nobody then also ADD --chown=nobody:nogroup fabio.properties /etc/fabio/fabio.properties or fabio can't read the config.

[tristanmorgan]

Sorry @Kamilcuk, can I ask for the changes to be limited to just one feature?
Upgrades to the go toolchain needs to be done in many places like the workflows files so should be a separate (and welcome) PR.

[aaronhurt]

This information is already in the docs as well: https://fabiolb.net/faq/binding-to-low-ports/

[Kamilcuk]

Hi, I am sorry. Should be ok now. I blame my headache.

[tristanmorgan]

Testing before this change:

$ docker run --rm -it -p 80:80 -u nobody:nogroup --network=host -v ${PWD}/fabio.properties:/etc/fabio/fabio.properties -e FABIO_proxy_addr=":80;proto=http" -e FABIO_registry_consul_addr=${CONSUL_HTTP_ADDR} fabio:before
....
2024/09/04 23:19:28 [FATAL] listen: Fail to listen. listen tcp :80: bind: permission denied

and after changes applied (and dropping the -v parameter too) the listener succeeds.

[tristanmorgan]

related #378