Mirrors/ProxMenux
1
0
Fork 0
mirror of https://github.com/MacRimi/ProxMenux.git synced 2026-11-02 10:52:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

oci: fix low-port and generated secret profiles

Browse Source
This commit is contained in:
Jonatan
2026-10-26 09:06:56 +01:00
parent a4fb46f861
commit 975a3b99cf
10 changed files with 184 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
oci/catalog/apps/clickhouse.json
+1 -2
View File
@@ -65,8 +65,7 @@
"example": "${GENERATED_CLICKHOUSE_PASSWORD}",
"required": true,
"sensitive": true,
"source": "upstream-documentation",
"prompt_user": false
"source": "upstream-documentation"
},
{
"name": "CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT",
oci/catalog/apps/mysql.json
+1 -2
View File
@@ -65,8 +65,7 @@
"example": "${GENERATED_MYSQL_ROOT_PASSWORD}",
"required": true,
"sensitive": true,
"source": "upstream-documentation",
"prompt_user": false
"source": "upstream-documentation"
}
],
"volumes": [
oci/catalog/apps/pdns-recursor.json
+19 -2
View File
@@ -32,7 +32,7 @@
"documentation": "https://doc.powerdns.com/recursor/",
"repository": "https://github.com/PowerDNS/pdns",
"tips": [
"The image uses the upstream default recursor configuration. Keep it on a trusted LAN and review the allowed client networks before changing its configuration."
"The image runs as the non-root pdns user. ProxMenux sets net.ipv4.ip_unprivileged_port_start=53 in this LXC's network namespace so it can listen on DNS port 53. This lets unprivileged processes in this LXC bind ports 53–1023; it does not change the Proxmox host or make the LXC privileged. Keep it on a trusted LAN and review the allowed client networks before changing its configuration."
],
"mini_changelog": [],
"display_version": null,
@@ -188,6 +188,14 @@
"stop_signal": "import-from-oci-image"
},
"adaptations": [
{
"id": "dns-low-ports-in-container-namespace",
"upstream_behavior": "The official image runs as the non-root pdns user and listens on DNS port 53; Docker Engine can provide a per-container NET_BIND_SERVICE capability.",
"native_lxc_behavior": "ProxMenux sets net.ipv4.ip_unprivileged_port_start=53 through this LXC's own network namespace configuration while keeping the LXC unprivileged.",
"reason": "The native OCI-LXC runner does not provide Docker's per-process capability grant. This namespaced sysctl enables the default DNS port without adding a capability or changing a host sysctl.",
"behavioral_impact": "Unprivileged processes in this LXC may bind ports 53 through 1023; the Proxmox host and other guests are unchanged.",
"validation": "pending-live-retest"
},
{
"id": "imported-compose-source",
"upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
@@ -317,7 +325,16 @@
"validation": "not-requested-by-compose"
}
],
"installer_profile": {},
"installer_profile": {
"security": {
"sysctls": [
{
"name": "net.ipv4.ip_unprivileged_port_start",
"value": "53"
}
]
}
},
"catalog": {
"replaces_discovered_ids": []
}
oci/catalog/apps/typesense.json
+1 -2
View File
@@ -65,8 +65,7 @@
"example": "${GENERATED_TYPESENSE_API_KEY}",
"required": true,
"sensitive": true,
"source": "upstream-documentation",
"prompt_user": false
"source": "upstream-documentation"
}
],
"volumes": [
oci/catalog/curated/clickhouse.json
+1 -2
View File
@@ -65,8 +65,7 @@
"example": "${GENERATED_CLICKHOUSE_PASSWORD}",
"required": true,
"sensitive": true,
"source": "upstream-documentation",
"prompt_user": false
"source": "upstream-documentation"
},
{
"name": "CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT",
oci/catalog/curated/mysql.json
+1 -2
View File
@@ -65,8 +65,7 @@
"example": "${GENERATED_MYSQL_ROOT_PASSWORD}",
"required": true,
"sensitive": true,
"source": "upstream-documentation",
"prompt_user": false
"source": "upstream-documentation"
}
],
"volumes": [
oci/catalog/curated/pdns-recursor.json
+19 -2
View File
@@ -32,7 +32,7 @@
"documentation": "https://doc.powerdns.com/recursor/",
"repository": "https://github.com/PowerDNS/pdns",
"tips": [
"The image uses the upstream default recursor configuration. Keep it on a trusted LAN and review the allowed client networks before changing its configuration."
"The image runs as the non-root pdns user. ProxMenux sets net.ipv4.ip_unprivileged_port_start=53 in this LXC's network namespace so it can listen on DNS port 53. This lets unprivileged processes in this LXC bind ports 53–1023; it does not change the Proxmox host or make the LXC privileged. Keep it on a trusted LAN and review the allowed client networks before changing its configuration."
],
"mini_changelog": [],
"display_version": null,
@@ -188,6 +188,14 @@
"stop_signal": "import-from-oci-image"
},
"adaptations": [
{
"id": "dns-low-ports-in-container-namespace",
"upstream_behavior": "The official image runs as the non-root pdns user and listens on DNS port 53; Docker Engine can provide a per-container NET_BIND_SERVICE capability.",
"native_lxc_behavior": "ProxMenux sets net.ipv4.ip_unprivileged_port_start=53 through this LXC's own network namespace configuration while keeping the LXC unprivileged.",
"reason": "The native OCI-LXC runner does not provide Docker's per-process capability grant. This namespaced sysctl enables the default DNS port without adding a capability or changing a host sysctl.",
"behavioral_impact": "Unprivileged processes in this LXC may bind ports 53 through 1023; the Proxmox host and other guests are unchanged.",
"validation": "pending-live-retest"
},
{
"id": "imported-compose-source",
"upstream_behavior": "The source definition deploys the complete Docker Compose application model.",
@@ -317,7 +325,16 @@
"validation": "not-requested-by-compose"
}
],
"installer_profile": {},
"installer_profile": {
"security": {
"sysctls": [
{
"name": "net.ipv4.ip_unprivileged_port_start",
"value": "53"
}
]
}
},
"catalog": {
"replaces_discovered_ids": []
}
oci/catalog/curated/typesense.json
+1 -2
View File
@@ -65,8 +65,7 @@
"example": "${GENERATED_TYPESENSE_API_KEY}",
"required": true,
"sensitive": true,
"source": "upstream-documentation",
"prompt_user": false
"source": "upstream-documentation"
}
],
"volumes": [