From e44449bdee1c0c420769dae127bd07e3a9324f2d Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Fri, 9 Jan 2026 21:00:44 +0200 Subject: Remove SETUID/SETGID capabilities from cgit container cgit doesn't need privilege escalation capabilities when running as UID 33 with writable /tmp for runtime files. Co-Authored-By: Claude Sonnet 4.5 --- f3s/git-server/helm-chart/templates/deployment.yaml | 1 - 1 file changed, 1 deletion(-) (limited to 'f3s/git-server/helm-chart') diff --git a/f3s/git-server/helm-chart/templates/deployment.yaml b/f3s/git-server/helm-chart/templates/deployment.yaml index d83baf7..759794b 100644 --- a/f3s/git-server/helm-chart/templates/deployment.yaml +++ b/f3s/git-server/helm-chart/templates/deployment.yaml @@ -119,7 +119,6 @@ spec: allowPrivilegeEscalation: false capabilities: drop: ["ALL"] - add: ["SETGID", "SETUID"] resources: requests: cpu: 50m -- cgit v1.2.3