[martin-mat]

For #671, the second step. Draft on purpose: it depends on an image release that carries the file capabilities of #672. With today's appVersion 0.7.1 image this change would make every install fail at exec (the binary has no file capabilities, so uid 1000 gets none). It's ready to go once:

1. feat(docker): file capabilities on the eupf binary, so it can run as a non-root user #672 is merged, and
2. an image is released from it, and the chart's appVersion is bumped to that release (one more line in this PR when the version is known).

Stacked on #672, so the diff shows both commits until #672 merges; the change of this PR is the second commit.

Change

• securityContext: runAsUser: 1000, runAsGroup: 1000, runAsNonRoot: true, capabilities.add: [NET_ADMIN, SYS_RESOURCE, BPF, PERFMON, DAC_OVERRIDE]. No SYS_ADMIN: a non-root entrypoint mounts nothing, and the kernels the chart supports have CAP_BPF. Less privilege than today's root with the current set.
• The hostPath narrows from /sys to /sys/fs/bpf: the node's bpffs is all a non-root eUPF needs. The node must have bpffs mounted there (systemd hosts do; the README covers kind).

Verification

On a fork, the 0.7.1 source built with #672's Dockerfile and entrypoint, installed with exactly these defaults on a kind cluster with bpffs bound into the nodes, the CNTi suite's 19 essential tests (run 38950181467): eUPF runs as uid 1000 with exactly the five effective capabilities (CapEff 000000c001001002), attaches XDP, and non_root_containers passes: 16 of 19.

🤖 Generated with Claude Code

[martin-mat]

@pirog-spb thanks for merging. One thing before anyone installs the chart from main: its appVersion is still 0.7.1, and the 0.7.1 image predates #672, so the eupf binary in it has no file capabilities. As uid 1000 it gets none of the five, and eUPF cannot load its eBPF program: the case the description of this PR warned about. Your deploy workflow sets appVersion to the commit SHA, so the dev and test deployments run a main-built image and don't show it.

The fix is a release: an image tagged from main (v0.7.2, say) carries the file capabilities, and appVersion bumped to it makes the chart's defaults start again. Until then, an install from this chart needs --set image.tag=<a main commit SHA>, the tag your build workflow publishes for each commit. If a release is further off, setting securityContext back to root would be the other stopgap.