From bf6c8479993640c12bd36e713555d8571ff15852 Mon Sep 17 00:00:00 2001 From: Derek Roberts Date: Fri, 17 Jul 2026 16:10:56 -0700 Subject: [PATCH 1/3] fix(frontend): strip file capabilities from caddy binary to allow execution without capabilities --- frontend/Dockerfile | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/frontend/Dockerfile b/frontend/Dockerfile index 2a925f46..4475a447 100644 --- a/frontend/Dockerfile +++ b/frontend/Dockerfile @@ -12,9 +12,10 @@ FROM caddy:2.11-alpine COPY --from=build /app/dist /app/dist COPY Caddyfile /etc/caddy/Caddyfile -# Packages and caddy format -RUN apk add --no-cache ca-certificates && \ - caddy fmt --overwrite /etc/caddy/Caddyfile +# Packages and remove file capabilities +RUN apk add --no-cache ca-certificates libcap && \ + setcap -r /usr/bin/caddy && \ + apk del libcap # Port, health check and non-root user EXPOSE 3000 3001 From 81a4c78e34ea58aa77604b10b6ce84abfe4e55ca Mon Sep 17 00:00:00 2001 From: Derek Roberts Date: Fri, 17 Jul 2026 18:17:55 -0700 Subject: [PATCH 2/3] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- frontend/Dockerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/frontend/Dockerfile b/frontend/Dockerfile index 4475a447..76566fc0 100644 --- a/frontend/Dockerfile +++ b/frontend/Dockerfile @@ -12,9 +12,10 @@ FROM caddy:2.11-alpine COPY --from=build /app/dist /app/dist COPY Caddyfile /etc/caddy/Caddyfile -# Packages and remove file capabilities +# Packages, remove file capabilities, and validate/format config RUN apk add --no-cache ca-certificates libcap && \ setcap -r /usr/bin/caddy && \ + caddy fmt --overwrite /etc/caddy/Caddyfile && \ apk del libcap # Port, health check and non-root user From 58e5444559b469835c497cc1e4194a6def54c5e9 Mon Sep 17 00:00:00 2001 From: Derek Roberts Date: Fri, 17 Jul 2026 18:19:21 -0700 Subject: [PATCH 3/3] Stop hiding Caddy formatting errors --- frontend/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/frontend/Dockerfile b/frontend/Dockerfile index 76566fc0..96239e7e 100644 --- a/frontend/Dockerfile +++ b/frontend/Dockerfile @@ -11,11 +11,11 @@ FROM caddy:2.11-alpine # Copy static files and config COPY --from=build /app/dist /app/dist COPY Caddyfile /etc/caddy/Caddyfile +RUN caddy fmt /etc/caddy/Caddyfile # Packages, remove file capabilities, and validate/format config RUN apk add --no-cache ca-certificates libcap && \ setcap -r /usr/bin/caddy && \ - caddy fmt --overwrite /etc/caddy/Caddyfile && \ apk del libcap # Port, health check and non-root user