Files
pgadmin4/docs/en_US
Ashesh Vashi 0d11dbc173 fix(docker): make CAP_NET_BIND_SERVICE optional for restricted runtimes (#9985)
The container previously applied CAP_NET_BIND_SERVICE to the python
interpreter so the non-root pgadmin user could bind to ports 80/443.
Some platforms refuse to honor file capabilities:

  - --cap-drop=ALL / OpenShift restricted-v2 SCC zero the bounding set,
    so the kernel returns EPERM on exec of any capability-tagged binary.
    This makes the image fail to start (issue #9657).
  - --security-opt=no-new-privileges / allowPrivilegeEscalation: false
    causes the kernel to silently strip file capabilities on exec, so
    the binary runs but a subsequent bind() to <1024 still fails.

Split the interpreter so neither default behavior nor restricted-runtime
support has to give up the other:

  - Dockerfile copies python3.X to /usr/local/bin/python3-cap and applies
    setcap to the copy. /usr/local/bin/python3.X stays un-capped, so
    /venv/bin/python3 (which symlinks to it) execs cleanly under
    restricted SCCs. A parallel /venv/bin/python3-cap symlink keeps the
    venv activation working when the capped interpreter is used.
  - entrypoint.sh reads /proc/self/status at startup. If NoNewPrivs is
    set, or CAP_NET_BIND_SERVICE is missing from the bounding set,
    gunicorn is invoked through the un-capped python and (when
    PGADMIN_LISTEN_PORT is unset) the default port falls back to 8080
    for plain HTTP or 8443 for TLS. A startup message records the
    choice.
  - Existing deployments with the default 80/443 mapping are unaffected:
    on every unrestricted runtime the bounding set still contains
    NET_BIND_SERVICE and gunicorn runs through the capped interpreter
    exactly as before.
  - PGADMIN_LISTEN_PORT, if set, is honored in both paths.

Docs gain a "Restricted Security Contexts" subsection covering the new
auto-detected fallback and the OpenShift / --cap-drop=ALL invocation.

Fixes #9657
2026-05-28 19:31:55 +05:30
..
2016-06-07 09:04:58 +01:00
2019-03-08 15:29:05 +00:00
2024-07-02 10:34:30 +05:30
2026-01-05 13:33:45 +05:30
2026-01-05 13:33:45 +05:30
2019-03-08 15:29:05 +00:00
2019-03-08 15:29:05 +00:00
2019-12-05 06:35:57 -05:00
2020-08-18 11:15:24 +01:00
2021-02-22 16:47:16 +05:30
2022-03-14 15:26:54 +00:00
2022-05-09 12:39:29 +05:30
2022-12-14 15:56:05 +05:30
2023-01-16 19:34:33 +05:30
2023-05-03 15:21:01 +05:30
2023-05-29 11:03:39 +05:30
2023-08-16 15:32:17 +05:30
2023-10-17 15:19:40 +05:30
2024-04-09 08:37:41 +05:30
2024-11-07 22:02:18 +05:30
2025-04-23 15:41:43 +05:30
2025-07-23 17:56:15 +05:30
2023-03-28 22:20:14 +05:30
2019-03-08 15:29:05 +00:00