From 418681d38ed5f1d554a86007a899ee018623021c Mon Sep 17 00:00:00 2001 From: cabbage Date: Fri, 11 Sep 2026 08:13:30 +0000 Subject: [PATCH] fix: run production server without root --- deploy/production/compose.yaml | 3 +++ test/windowsnative/native_fixture_test.go | 1 + 2 files changed, 4 insertions(+) diff --git a/deploy/production/compose.yaml b/deploy/production/compose.yaml index 989e44c..a30ed73 100644 --- a/deploy/production/compose.yaml +++ b/deploy/production/compose.yaml @@ -27,6 +27,9 @@ services: server: image: "${RVBOX_SERVER_IMAGE:?set RVBOX_SERVER_IMAGE to a pinned rvbox-server image}" + # The init container is the only root process. Its exact 65532 ownership + # setup lets the long-lived server run without host/container root power. + user: "65532:65532" restart: unless-stopped command: ["--config", "/etc/rvbox/server.toml"] read_only: true diff --git a/test/windowsnative/native_fixture_test.go b/test/windowsnative/native_fixture_test.go index b48edab..881b6c9 100644 --- a/test/windowsnative/native_fixture_test.go +++ b/test/windowsnative/native_fixture_test.go @@ -91,6 +91,7 @@ func TestProductionComposeAssets_HP_OPS_01(t *testing.T) { "RVBOX_SERVER_CONFIG:-./server.toml", "RVBOX_HTTPS_BIND:-0.0.0.0", "nginx@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10", + "user: \"65532:65532\"", "nofile:", "soft: 65536", "hard: 65536", "condition: service_completed_successfully", "condition: service_healthy",