Repository navigation
feat(docker): file capabilities on the eupf binary, so it can run as a non-root user - #672
Merged
Merged
Conversation
…a non-root user eUPF needs no root: BPF and PERFMON load the programs (SYS_ADMIN on kernels before CAP_BPF), NET_ADMIN attaches XDP and sets routes, SYS_RESOURCE raises RLIMIT_MEMLOCK. The one thing uid 0 did that the capabilities don't is creating the map pin directory under /sys/fs/bpf, whose root directory belongs to root; DAC_OVERRIDE covers that. The runtime stage now sets these as file capabilities (=ep) on /app/bin/eupf. The container's bounding set still decides which of them the process can have, so nothing changes for a container that doesn't grant them, and the image keeps running as root by default. The entrypoint mounts bpffs and debugfs only when it runs as root: a non-root process cannot, and expects the node's bpffs at /sys/fs/bpf, as systemd hosts provide. The chart documents the non-root security context and the bpffs prerequisite; its default stays root until an image release carries the file capabilities. Verified on a fork with the 0.7.1 source built this way: eupf runs as uid 1000 with exactly the intended effective capabilities, attaches XDP, and the CNTi suite's non_root_containers test passes. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: Martin Matyas <martin.matyas@tieto.com>
This was referenced Oct 16, 2026
pirog-spb
reviewed
Oct 21, 2026
pirog-spb
approved these changes
Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
For #671, the first step: the image. Nothing changes for current users; the image keeps running as root by default.
Change
Dockerfile: the runtime stage setsNET_ADMIN, SYS_RESOURCE, BPF, PERFMONandDAC_OVERRIDEas file capabilities (=ep) on/app/bin/eupf. They're what eUPF needs: loading the programs (BPF,PERFMON; the chart requires kernel 5.15, which hasCAP_BPF), attaching XDP and setting routes (NET_ADMIN), raisingRLIMIT_MEMLOCK(SYS_RESOURCE), and creating the map pin directory under the root-owned/sys/fs/bpf(DAC_OVERRIDE). The container's bounding set still decides which of them the process gets. Whoever runs the image must grant all of them, root or not (the chart's defaults do;docker runneeds--privilegedor--cap-add): exec of a binary with the effective bit set fails withOperation not permittedwhen one is missing.entrypoint.sh: mounts bpffs and debugfs only when running as root. A non-root process can't mount, and uses the node's bpffs at/sys/fs/bpf.securityContextdocumented invalues.yaml(commented) and in the README's cluster prerequisites, with the bpffs node prerequisite and the kindextraMountsline. The default stays root until an image release carries the file capabilities; that's the second step in eUPF can run as a non-root user with file capabilities; today the chart runs it as root #671. Chart 0.7.2.Verification
On a fork, the 0.7.1 source built with this Dockerfile and entrypoint, installed with the documented non-root security context on a kind cluster with bpffs bound into the nodes, the CNTi suite's 19 essential tests (run 38950181467): eUPF runs as uid 1000 with exactly the five effective capabilities (
CapEff 000000c001001002, noSYS_ADMIN), attaches XDP, andnon_root_containerspasses: 16 of 19. The same image as root with the chart's current defaults starts as before (run 38942371982,mainsource).#673 also bumps the chart to 0.7.2; whichever merges second needs a one-line rebase.
🤖 Generated with Claude Code