From c99070c1059051915207bed051c9fd43aa8a2b99 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Sun, 14 Jun 2026 22:17:32 +0200 Subject: [PATCH] komga + audiobookshelf: add no-new-privileges (root-fallback hardening) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Address security review: reverting to root removed the user:1000 boundary, so add security_opt no-new-privileges:true to block SUID-based escalation. Full cap_drop is intentionally NOT applied — the images' root-init needs CHOWN/SETUID/SETGID to set up /config and /metadata (dropping them reproduces the crash we hit at user:1000). Co-Authored-By: Claude Opus 4.8 (1M context) --- templates/audiobookshelf/docker-compose.yml | 5 +++++ templates/komga/docker-compose.yml | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/templates/audiobookshelf/docker-compose.yml b/templates/audiobookshelf/docker-compose.yml index 8a1dd3a..9fd0523 100644 --- a/templates/audiobookshelf/docker-compose.yml +++ b/templates/audiobookshelf/docker-compose.yml @@ -20,6 +20,11 @@ services: image: ghcr.io/advplyr/audiobookshelf:2.19.5 container_name: audiobookshelf restart: unless-stopped + # Runs as root (see note above). Restore an escalation boundary: block SUID-based privilege + # escalation. Full cap_drop is NOT applied — the image's root-init needs file-ownership caps to + # set up /metadata, and dropping them reproduces the EACCES failure we hit pinning user:1000. + security_opt: + - no-new-privileges:true environment: - TZ=Europe/Budapest volumes: diff --git a/templates/komga/docker-compose.yml b/templates/komga/docker-compose.yml index 9d315a7..316fcff 100644 --- a/templates/komga/docker-compose.yml +++ b/templates/komga/docker-compose.yml @@ -19,6 +19,11 @@ services: image: gotson/komga:1.20.0 container_name: komga restart: unless-stopped + # Runs as root (see note above). Restore an escalation boundary: block SUID-based privilege + # escalation. Full cap_drop is NOT applied — the image's root-init needs CHOWN/SETUID/SETGID to + # set up /config, and dropping them crash-loops it (the same failure we hit pinning user:1000). + security_opt: + - no-new-privileges:true environment: - TZ=Europe/Budapest volumes: