This is a reproduction case for gitpod.io bug gitpod-io/gitpod#3721
This repo is pushed to hub.docker.com as randyfay/cap-add-demo
The key element is that this docker repo has setcap CAP_NET_BIND_SERVICE=+eip /bin/nc.traditional
, which allows /bin/nc.traditional to access privileged ports (like port 80).
Build and push with docker buildx build --push --platform=linux/amd64,linux/arm64 -t randyfay/cap-add-demo .
To run it and see if nc.traditional has cap_net_bind_service, docker run -it randyfay/cap-add-demo getcap /bin/nc.traditional
Full steps to demonstrate loss of the cap_net_bind_service capacity on restore of an image in gitpod.io:
- Run this repo with gitpod: https://aledbf-killdocker.staging.gitpod-dev.com/#https://github.com/rfay/cap-add-demo
You should see "/bin/nc.traditional = cap_net_bind_service+eip", which means that the nc.traditional binary has the cap_net_bind_service capability.
-
Stop the gitpod workspace, then restart it.
-
Run this repo again with gitpod: https://aledbf-killdocker.staging.gitpod-dev.com/#https://github.com/rfay/cap-add-demo
You will not see the required output, in other words you will not see "/bin/nc.traditional = cap_net_bind_service+eip", because the cap_net_bind_service_capability has been lost.