{"action":"created","issue":{"url":"https://api.github.com/repos/joshix/caddybox/issues/18","repository_url":"https://api.github.com/repos/joshix/caddybox","labels_url":"https://api.github.com/repos/joshix/caddybox/issues/18/labels{/name}","comments_url":"https://api.github.com/repos/joshix/caddybox/issues/18/comments","events_url":"https://api.github.com/repos/joshix/caddybox/issues/18/events","html_url":"https://github.com/joshix/caddybox/issues/18","id":123195062,"number":18,"title":"caddy runs as root","user":{"login":"joshix","id":72905,"avatar_url":"https://avatars.githubusercontent.com/u/72905?v=3","gravatar_id":"","url":"https://api.github.com/users/joshix","html_url":"https://github.com/joshix","followers_url":"https://api.github.com/users/joshix/followers","following_url":"https://api.github.com/users/joshix/following{/other_user}","gists_url":"https://api.github.com/users/joshix/gists{/gist_id}","starred_url":"https://api.github.com/users/joshix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshix/subscriptions","organizations_url":"https://api.github.com/users/joshix/orgs","repos_url":"https://api.github.com/users/joshix/repos","events_url":"https://api.github.com/users/joshix/events{/privacy}","received_events_url":"https://api.github.com/users/joshix/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/joshix/caddybox/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/joshix/caddybox/labels/help%20wanted","name":"help wanted","color":"159818"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-12-21T01:31:53Z","updated_at":"2016-06-17T10:41:09Z","closed_at":null,"body":"As of #16, caddy runs as `UID 0` (root) in the container\r\n\r\nCaddy must bind privileged ports to do TLS most simply. This requires either user privileges, like running as `root`, or using the linux *capabilities* facility to grant certain powers to the executable binary itself, e.g.,\r\n\r\n  ```sh\r\n  $ setcap cap_net_bind_service=+ep /bin/caddy\r\n  ```\r\n\r\nAn external `setcap` on `rootfs/bin/caddy` is not reflected into the container. Running `setcap` inside the container at `docker build` time requires a distro base image, like Alpine. See the [`setcap` branch](https://github.com/joshix/caddybox/tree/setcap) for an exploration of this approach.\r\n\r\nOther potential solutions:\r\n* Caddybox could run `/bin/caddy` as non-root and only bind unprivileged ports inside the container. Then docker proxy listens on the standard ports and redirects (as in the non-LE examples in the [README](https://github.com/joshix/caddybox/blob/master/README.md)).\r\n* (Upstream) Caddy could drop privileges after binding ports: Blocked on a [golang issue with dropping privileges among goroutines](https://github.com/golang/go/issues/1435)\r\n* (Upstream) Docker and linux could completely implement UID namespaces"},"comment":{"url":"https://api.github.com/repos/joshix/caddybox/issues/comments/226738131","html_url":"https://github.com/joshix/caddybox/issues/18#issuecomment-226738131","issue_url":"https://api.github.com/repos/joshix/caddybox/issues/18","id":226738131,"user":{"login":"joshix","id":72905,"avatar_url":"https://avatars.githubusercontent.com/u/72905?v=3","gravatar_id":"","url":"https://api.github.com/users/joshix","html_url":"https://github.com/joshix","followers_url":"https://api.github.com/users/joshix/followers","following_url":"https://api.github.com/users/joshix/following{/other_user}","gists_url":"https://api.github.com/users/joshix/gists{/gist_id}","starred_url":"https://api.github.com/users/joshix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joshix/subscriptions","organizations_url":"https://api.github.com/users/joshix/orgs","repos_url":"https://api.github.com/users/joshix/repos","events_url":"https://api.github.com/users/joshix/events{/privacy}","received_events_url":"https://api.github.com/users/joshix/received_events","type":"User","site_admin":false},"created_at":"2016-06-17T10:41:09Z","updated_at":"2016-06-17T10:41:09Z","body":"On the rkt/ACI branch, ref https://github.com/coreos/rkt/blob/master/Documentation/capabilities-guide.md"}}
{"actor":{"display_login":"joshix"}}