Skip to content

Drop as much capabilities as possibile for the Collabora container #8000

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Fs00 wants to merge 4 commits into
base: main
Choose a base branch
from
+17 −4
Open

Drop as much capabilities as possibile for the Collabora container #8000

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
43d8393
Handle cap_drop from container definitions
Fs00 Apr 25, 2026
d0d58df
Set Collabora cap_drop to ALL in containers.json
Fs00 Apr 25, 2026
61eab04
Drop any extra caps for collabora when seccomp profile is enabled
Fs00 Apr 25, 2026
5dbc642
Drop NET_RAW cap by default when no caps are explicitly dropped
Fs00 Apr 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion php/containers.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -406,7 +406,7 @@
"CHOWN"
],
"cap_drop": [
"NET_RAW"
"ALL"
]
},
{
Expand Down
2 changes: 2 additions & 0 deletions php/src/Container/Container.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@ public function __construct(
public bool $enableNvidiaGpu,
/** @var string[] */
public array $capAdd,
/** @var string[] */
public array $capDrop,
public int $shmSize,
public bool $apparmorUnconfined,
/** @var string[] */
Expand Down
6 changes: 6 additions & 0 deletions php/src/ContainerDefinitionFetcher.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -298,6 +298,11 @@ private function GetDefinition(): array
$capAdd = $entry['cap_add'];
}

$capDrop = [];
if (isset($entry['cap_drop'])) {
$capDrop = $entry['cap_drop'];
}

$shmSize = -1;
if (isset($entry['shm_size'])) {
$shmSize = $entry['shm_size'];
Expand Down Expand Up @@ -360,6 +365,7 @@ private function GetDefinition(): array
$devices,
$enableNvidiaGpu,
$capAdd,
$capDrop,
$shmSize,
$apparmorUnconfined,
$backupVolumes,
Expand Down
11 changes: 8 additions & 3 deletions php/src/Docker/DockerActionManager.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -378,8 +378,11 @@ public function CreateContainer(Container $container): void {
$requestBody['HostConfig']['CapAdd'] = $capAdds;
}

// Disable arp spoofing
if (!in_array('NET_RAW', $capAdds, true)) {
$capDrops = $container->capDrop;
if (count($capDrops) > 0) {
Comment thread
Fs00 marked this conversation as resolved.
$requestBody['HostConfig']['CapDrop'] = $capDrops;
} else if (!in_array('NET_RAW', $capAdds, true)) {
// Prevent ARP spoofing by default
$requestBody['HostConfig']['CapDrop'] = ['NET_RAW'];
Comment on lines 383 to +386
Copy link
Copy Markdown
Collaborator

@szaimen szaimen Apr 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please put the logic back to where it was initially places in this file?

}

Expand Down Expand Up @@ -440,9 +443,11 @@ public function CreateContainer(Container $container): void {
// Special things for the collabora container which should not be exposed in the containers.json
} elseif ($container->identifier === 'nextcloud-aio-collabora') {
if (!$this->configurationManager->collaboraSeccompDisabled) {
// Load reference seccomp profile for collabora
// Load reference seccomp profile for collabora...
$seccompProfile = (string)file_get_contents(DataConst::GetCollaboraSeccompProfilePath());
$requestBody['HostConfig']['SecurityOpt'] = ["label:disable", "seccomp=$seccompProfile"];
// ...which allows the collabora container to run without any capabilities
$requestBody['HostConfig']['CapAdd'] = [];
}

// Additional Collabora options
Expand Down
Loading